Framework Category

Cybersecurity Supply Chain Risk Management

Cybersecurity Supply Chain Risk Management addresses risks posed by third-party relationships through defined policies, roles, and procedures.

It involves assessing and managing supplier risks across the full lifecycle—from onboarding to offboarding—ensuring integration with broader cybersecurity and enterprise risk strategies, and including suppliers in incident response and recovery planning.

Implementation Questions

GV.SC-01

A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders

Has your organization established a documented strategy that defines the objectives of your cybersecurity supply chain risk management program?

A cybersecurity supply chain risk management strategy defines how your organization identifies, assesses, and mitigates risks from third-party vendors, suppliers, and partners who have access to your systems or data.

Has your organization developed a formal cybersecurity supply chain risk management program with documented policies, procedures, and an implementation plan with milestones that is shared with relevant stakeholders?

A cybersecurity supply chain risk management program helps identify, assess, and mitigate risks from third-party vendors, suppliers, and service providers that may have access to your systems or data. This program should include formal policies defining roles and responsibilities, procedures for vendor assessment and monitoring, and a roadmap for continuous improvement with clear milestones.

Has your organization developed and implemented the processes from the cybersecurity supply chain risk management program, that align with your security strategy, objectives, policies, and procedures with documented stakeholder agreement and participation?

Turning strategy into practice is the focus here, specifically whether your C-SCRM program has been operationalized through defined processes with documented stakeholder agreement and participation. These processes should be formally documented, agreed upon by relevant stakeholders, and actively performed across the organization. Without this alignment, security initiatives may lack direction, coordination, and organizational buy-in.

Has your organization established a formal cross-functional team or committee responsible for cybersecurity supply chain risk management?

A cross-functional cybersecurity supply chain risk management team ensures that all relevant departments (IT, security, legal, procurement, etc.) collaborate to identify, assess, and mitigate supply chain security risks. This coordination prevents siloed approaches that might miss critical vulnerabilities and ensures consistent security practices across the supply chain ecosystem.

GV.SC-02

Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally

Has your organization formally designated specific roles or positions responsible for cybersecurity supply chain risk management activities?

Establishing clear ownership for supply chain risk management ensures accountability and prevents critical security tasks from falling through organizational gaps. These designated roles should have defined responsibilities for identifying, assessing, and mitigating risks from third-party vendors, suppliers, and service providers throughout the supply chain lifecycle.

Has your organization documented cybersecurity supply chain risk management roles and responsibilities in a formal policy?

Supply chain accountability is under review, namely whether you have documented the roles and responsibilities for managing cybersecurity risk across vendors in a formal policy. Documenting these roles ensures accountability, prevents gaps in oversight, and establishes clear procedures for addressing supply chain security incidents or vulnerabilities.

Has your organization established a responsibility matrix that clearly defines roles for cybersecurity supply chain risk management activities?

A responsibility matrix (such as RACI - Responsible, Accountable, Consulted, Informed) documents which teams or individuals are responsible for specific supply chain security activities, ensuring clear ownership and communication channels. This prevents critical security tasks from falling through the cracks and establishes accountability for supply chain risk management across the organization.

Are cybersecurity supply chain risk management responsibilities and performance requirements explicitly included in relevant job descriptions and personnel documentation?

Including specific cybersecurity supply chain risk management responsibilities in job descriptions creates clear accountability and ensures staff understand their security obligations when dealing with vendors and third parties. This practice helps organizations operationalize supply chain security by making it part of formal role expectations rather than an implicit or ad-hoc responsibility.

Has your organization established documented performance goals for personnel with cybersecurity risk management responsibilities, and do you periodically measure performance against these goals?

Performance management for security staff is under review, covering whether you set documented performance goals for cybersecurity personnel and periodically measure them against those goals. Performance goals should be specific, measurable, and aligned with your organization's overall security objectives, such as reducing incident response time, improving vulnerability remediation rates, or enhancing security awareness training effectiveness.

Has your organization defined and documented roles and responsibilities for cybersecurity risk management in third-party relationships, and integrated these into relevant agreements?

Third-party risk ownership is under review, specifically whether roles and responsibilities for managing supplier and partner cyber risk are defined, documented, and written into agreements. Defining these responsibilities helps prevent security gaps where each party assumes the other is handling a particular security control.

Has your organization clearly communicated the roles and responsibilities for managing cybersecurity supply chain risks related to third parties?

Clarity of ownership over supply-chain cyber risk is what reviewers want, namely whether roles and responsibilities for managing third-party risks have been defined and communicated. Clear role definition ensures accountability for tasks such as vendor risk assessments, contract security requirements, ongoing monitoring, and incident response related to third parties.

Has your organization established formal rules and protocols for information sharing and reporting with suppliers?

Structured information sharing with suppliers is the subject here, namely whether you have documented rules governing how security incidents, vulnerabilities, and updates are reported between you and your suppliers. These protocols should define what information can be shared, with whom, through which channels, and under what circumstances.

GV.SC-03

Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes

Has your organization formally identified and documented areas of alignment and overlap between cybersecurity and enterprise risk management frameworks?

Framework alignment is the concern here, namely whether you have formally identified and documented where cybersecurity and enterprise risk management overlap and connect. Identifying these alignments helps ensure cybersecurity risks are properly considered within the organization's overall risk appetite and management approach, rather than being treated in isolation.

Has your organization established integrated control sets that address both cybersecurity risk management and cybersecurity supply chain risk management?

Integrated control sets ensure that cybersecurity risk management practices are consistently applied across both internal operations and the supply chain.

Has your organization integrated cybersecurity supply chain risk management into your continuous improvement processes?

Supply chain risk in continuous improvement is the focus: whether you routinely identify, evaluate, and mitigate threats from vendors and suppliers as part of your improvement cycles. Effective integration means supply chain risks are considered during procurement, vendor selection, contract negotiations, and ongoing vendor management activities, with established processes for regular reassessment and improvement.

Does your organization have a documented process for escalating material cybersecurity risks identified in your supply chain to senior management and addressing them within your enterprise risk management framework?

Escalation of supply chain risk is what's being checked: whether material risks identified in your supply chain are formally raised to senior management and handled within enterprise risk management.

GV.SC-04

Suppliers are known and prioritized by criticality

Has your organization established formal criteria for determining supplier criticality based on data sensitivity, system access levels, and business impact?

Ranking suppliers by risk is the focus: assessors want formal criteria that set supplier criticality from data sensitivity, system access levels, and business impact.

Does your organization maintain a comprehensive supplier inventory that includes criticality ratings for each supplier?

A supplier inventory helps organizations track all third parties that provide goods or services, while criticality ratings identify which suppliers pose the greatest risk or are most essential to operations.

GV.SC-05

Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties

Has your organization established security requirements for suppliers, products, and services based on their criticality level and potential impact?

Risk-proportionate requirements are what's being examined, namely whether you set security expectations for suppliers, products, and services according to their criticality and potential impact. For example, a cloud provider hosting sensitive data would have more stringent security requirements than an office supply vendor. Similarly, critical software components would require more thorough security assessments than non-critical tools.

Does your organization include comprehensive cybersecurity and supply chain requirements in standard contract language with third parties, along with verification methods for compliance?

Third-party relationships often introduce significant security risks when vendors don't maintain the same security standards as your organization.

Has your organization established formal rules and protocols for information sharing with suppliers and sub-tier suppliers in your contractual agreements?

Contractual information-sharing rules are the subject here: whether your agreements set out formal protocols for how sensitive information moves to suppliers and their sub-tier suppliers.

Does your organization include security requirements in agreements with vendors and partners based on the criticality of the data or systems involved?

Including security requirements in agreements helps ensure that third parties handling your data or accessing your systems maintain appropriate security controls. The level of security requirements should be proportional to the criticality of the data/systems and the potential impact if compromised. For example, a vendor processing sensitive customer data would have stricter requirements than one providing office supplies.

Has your organization defined specific security requirements in service-level agreements (SLAs) that allow for monitoring supplier security performance throughout the relationship lifecycle?

Supplier oversight through contracts is the focus, asking whether your SLAs define specific security requirements that let you monitor supplier security performance across the relationship.

Does your organization require suppliers to contractually disclose cybersecurity features, vulnerabilities, and functions of their products/services throughout the entire lifecycle or service term?

Supplier transparency is the concern: whether contracts oblige suppliers to disclose the security features, vulnerabilities, and functions of their products throughout the lifecycle or service term. Without such contractual obligations, suppliers may not disclose known vulnerabilities, security features may go unused, and your organization could remain unaware of critical security information that affects your risk posture.

Do you contractually require suppliers to provide and maintain a current component inventory (e.g., software or hardware bill of materials) for critical products?

Component transparency from suppliers is the subject here, covering whether contracts require a current bill of materials for the software or hardware in critical products. Having a complete bill of materials (BOM) enables you to quickly identify affected systems when vulnerabilities are discovered in specific components, assess supply chain risks, and manage product security throughout its lifecycle.

Does your organization require suppliers to implement employee vetting procedures and insider threat controls in contractual agreements?

Supplier personnel risk is what's being assessed: whether your contracts require suppliers to vet their employees and put insider threat controls in place. Supplier employees often have access to your sensitive data or systems, and inadequate vetting by suppliers creates security vulnerabilities that could impact your organization.

Does your organization require suppliers to provide evidence of their security practices through formal attestation, certification, or inspection processes?

Supplier assurance is at issue: reviewers want to know whether you require suppliers to evidence their security practices through attestation, certification, or inspection. By requiring evidence such as SOC 2 reports, ISO 27001 certifications, completed security questionnaires, or allowing security inspections, you can validate that third parties handling your data meet your security standards.

Does your organization include specific cybersecurity risk management provisions in contracts and agreements with suppliers and their supply chains?

Contractual supply chain provisions are what's being checked: whether your supplier agreements spell out cybersecurity responsibilities and liabilities across the chain.

GV.SC-06

Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships

Does your organization conduct risk-based due diligence assessments on prospective suppliers prior to establishing business relationships?

Supplier due diligence is the subject, namely whether you run risk-based assessments of prospective suppliers before entering into business relationships. Due diligence should include assessments of suppliers' security practices, financial stability, compliance history, and operational capabilities, with the depth of assessment proportional to the criticality of the supplier relationship and access to sensitive data or systems.

Does your organization have a formal process to assess the cybersecurity capabilities and risk management practices of potential suppliers before engagement?

Supplier due diligence before engagement is what's being checked, specifically whether you assess a prospective vendor's cybersecurity capabilities and risk practices before signing on. A robust supplier assessment process should examine technical security controls, compliance certifications, incident response capabilities, and the supplier's own third-party risk management practices.

Does your organization perform risk assessments of suppliers against business requirements and cybersecurity standards?

Supplier risk assessments help identify potential security vulnerabilities in your supply chain that could impact your organization's security posture. These assessments evaluate suppliers based on their access to your systems/data, the criticality of their services, and their own security controls implementation against your requirements and industry standards.

Does your organization have a formal process to verify the authenticity, integrity, and security of critical products before acquisition and deployment?

Pre-acquisition assurance is the subject: this item asks whether you have a formal process to verify the authenticity, integrity, and security of critical products before you deploy them.

GV.SC-07

The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship

Does your organization adjust third-party assessment formats and frequencies based on the vendor's reputation and the criticality of their products or services?

Risk-based vendor assessment is what this examines, specifically whether you adjust the format and frequency of third-party reviews according to a vendor's reputation and how critical their products or services are.

Does your organization have a formal process to collect and evaluate evidence of third-party compliance with contractual cybersecurity requirements?

Verifying third-party compliance is the concern here: the question is whether you have a formal process to collect and evaluate evidence that vendors meet their contractual cybersecurity obligations. This includes collecting and evaluating documentation such as self-attestations, warranties, certifications (like SOC 2, ISO 27001), audit reports, and security questionnaire responses from vendors and partners.

Does your organization regularly monitor critical suppliers' compliance with security obligations through inspections, audits, tests, or other evaluation methods?

Ongoing supplier oversight is what's assessed, namely whether you verify critical suppliers' security compliance through inspections, audits, tests, or comparable evaluations. Effective supplier monitoring helps identify security gaps before they lead to incidents and ensures continuous compliance with your security requirements.

Does your organization have a formal process to monitor critical suppliers, services, and products for changes in their risk profiles and update their criticality assessments accordingly?

Vendor risk treated as ongoing rather than one-and-done is the focus, specifically whether you monitor critical suppliers, services, and products for shifts in risk and update their criticality. Changes in a supplier's security posture, ownership, geographic location, or financial stability can significantly impact the risk they pose to your organization.

Has your organization established a business continuity plan that specifically addresses supplier and supply chain interruptions?

A business continuity plan for supply chain disruptions helps organizations maintain critical operations during unexpected supplier issues such as vendor bankruptcy, natural disasters affecting suppliers, geopolitical conflicts, or transportation disruptions. This plan should identify critical suppliers, alternative sourcing options, inventory management strategies, and communication protocols for supply chain emergencies.

GV.SC-08

Relevant suppliers and other third parties are included in incident planning, response, and recovery activities

Has your organization established formal incident response communication protocols with suppliers that define rules for reporting incidents, recovery activities, and status updates?

Coordinated incident communication with suppliers is the focus, specifically whether you have formal protocols defining how incidents, recovery activities, and status updates are reported between you. Effective supplier communication protocols help minimize incident impact by establishing when and how suppliers should report incidents that may affect your organization, and how your organization communicates incidents that may impact suppliers.

Has your organization formally documented the incident response roles and responsibilities for both internal teams and external suppliers?

Clarity of incident roles is the focus here, specifically whether you have documented incident response responsibilities for both your internal teams and your external suppliers. Clear role definition prevents confusion during incidents, ensures proper coordination, and establishes accountability for incident response activities across organizational boundaries.

Does your organization include critical suppliers in incident response exercises and simulations?

Including critical suppliers in incident response exercises ensures coordinated response capabilities during security incidents that may involve or impact your supply chain. This practice helps identify communication gaps, clarify roles and responsibilities, and test the effectiveness of response procedures across organizational boundaries.

Has your organization established and documented crisis communication protocols with your critical suppliers?

Crisis communication protocols ensure that during security incidents, system outages, or other emergencies, your organization can effectively coordinate responses with critical suppliers. These protocols should define communication channels, escalation procedures, contact information for key personnel, and the types of events that trigger communications.

Does your organization conduct formal lessons learned sessions with critical suppliers following significant projects, incidents, or on a regular cadence?

Collaborative lessons learned sessions with critical suppliers help identify areas for improvement in security practices, communication protocols, and incident response procedures. These sessions can uncover vulnerabilities in the supply chain, establish better coordination mechanisms, and strengthen relationships with key suppliers who may have access to sensitive systems or data.

GV.SC-09

Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle

Does your organization maintain provenance records for all acquired technology products and services?

Technology provenance records document the origin, chain of custody, and authenticity of technology products and services your organization acquires.

Does your organization provide regular risk reporting to leadership regarding the authenticity and integrity of acquired components?

Component integrity reporting is the subject: whether you verify the authenticity of acquired hardware, software, and services and report those findings up to leadership. Supply chain attacks often target organizations through compromised components, making verification and leadership awareness critical security controls.

Does your organization have a documented process for ensuring that software patches, updates, and upgrades are acquired only from authenticated and trustworthy sources?

Software supply chain integrity is at issue here: whether you have a documented process to ensure patches, updates, and upgrades come only from authenticated, trustworthy sources. Without proper verification, organizations risk installing compromised software that could contain malware or backdoors, potentially leading to data breaches or system compromise.

Does your organization have policies requiring that only approved supplier personnel perform maintenance on supplier products?

Controlled maintenance is the concern here: whether your policies require that only supplier-approved personnel perform maintenance on supplier products. Such policies help prevent unauthorized modifications, reduce the risk of introducing vulnerabilities, and maintain warranty compliance.

Does your organization have documented policies and procedures for verifying critical hardware upgrades against unauthorized changes before implementation?

This control ensures that hardware upgrades are thoroughly inspected for potential tampering, unauthorized modifications, or supply chain compromises before being deployed in your environment. For example, firmware updates for network devices, server components, or security appliances should be verified for integrity and authenticity to prevent the introduction of backdoors or malicious code.

GV.SC-10

Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement

Has your organization established formal processes for terminating critical third-party relationships under both normal and adverse circumstances?

Critical relationships with vendors, partners, and service providers require clear termination procedures to minimize security risks when these relationships end. Without proper termination processes, organizations risk data breaches, service disruptions, or compliance violations during transitions.

Has your organization established and implemented a formal plan for managing component end-of-life, maintenance support, and obsolescence?

Managing technology through its decline is the focus, specifically whether you have a formal plan for component end-of-life, maintenance support, and obsolescence. Without proper planning, organizations risk using unsupported components that may contain unpatched security vulnerabilities, face unexpected costs for emergency replacements, or experience operational disruptions when critical components fail without available replacements.

Does your organization have a process to promptly deactivate supplier access to systems and resources when it is no longer required?

Maintaining active access for suppliers after their engagement has ended creates unnecessary security risks. This includes ensuring that temporary vendor accounts, VPN access, cloud resource permissions, and physical access credentials are revoked immediately upon project completion or contract termination.

Does your organization have a documented process for the timely return and secure disposal of assets containing organizational data?

Asset recovery and disposal is the concern: whether a documented process ensures that devices and media holding organizational data are returned or securely destroyed once no longer needed. Without proper asset return and disposal processes, organizational data may remain accessible to unauthorized individuals, potentially leading to data breaches or compliance violations.

Does your organization have a documented process for terminating or transitioning supplier relationships that specifically addresses supply chain security risks and resilience?

Secure supplier offboarding is what's being checked, namely whether you have a documented process for ending or transitioning supplier relationships that addresses supply chain security and resilience. Without proper termination/transition planning, organizations risk data breaches, service disruptions, or compliance violations during these critical periods.

Has your organization implemented a formal supplier termination process that addresses data security and system access risks?

When supplier relationships end, there are significant risks if access to systems and data isn't properly revoked, or if data transfer/destruction isn't managed securely. This question assesses whether your organization has formalized procedures to mitigate these risks during supplier offboarding.

Does your organization have documented procedures for managing data leakage risks when terminating supplier relationships?

When supplier relationships end, there's a risk that sensitive data may be retained by the supplier or improperly handled during the transition.