Has your organization established integrated control sets that address both cybersecurity risk management and cybersecurity supply chain risk management?

Integrated control sets ensure that cybersecurity risk management practices are consistently applied across both internal operations and the supply chain.

This approach prevents security gaps that could arise when treating these domains separately and promotes efficiency by avoiding redundant controls.

Organizations with mature integrated control sets typically have unified governance frameworks, shared risk assessment methodologies, and consistent security requirements for both internal systems and external suppliers.

Evidence could include documentation of a unified control framework (such as a mapping document showing how controls address both internal and supply chain risks), governance documentation showing integrated risk management processes, or a security policy that explicitly addresses both domains under a common framework.