NIST CSF 2.0 · derived mapping target
GV.OC-05Dependencies understood
Map the outside services, suppliers, and infrastructure your own operations depend on, and make those dependencies visible. You cannot manage a risk you have not named.
Mapping at a glance
GV.OC-05Dependencies understoodNIST CSF 2.0
GV.OC-05 is covered by 9 Sekit CSF controls. +4 more in the table below. Open in the full graph →
Mapped from the Sekit CSF
The Sekit controls that cover this requirement, lens by lens.
RCF-0016Regulatory compliance · PolicyRCF-0017Regulatory compliance · ProcessRCF-0018Regulatory compliance · TechnicalRCF-0376Compliance calendar · PolicyRCF-0377Compliance calendar · ProcessRCF-0378Compliance calendar · TechnicalRCF-0379Regulatory mapping · PolicyRCF-0380Regulatory mapping · ProcessRCF-0381Regulatory mapping · Technical
ISO/IEC 27001:2022 counterparts
Reached through the Sekit CSF controls both map to — a mapping, not a formal equivalence.
ISO/IEC 42001:2023 — Annex A counterparts
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
Software and SaaS inventory
The list of installed software and cloud apps the company uses, with their licences, and a sense of which tools people use that are not officially approved.
Vendor due diligence and monitoring
How the company assesses a supplier's security before hiring and monitors it during the relationship, including the process when it ends.
Organizational context and security scope
The document that captures the business mission and objectives, the interested parties (customers, regulators, partners, staff) and what they expect, the critical services others rely on, and the external dependencies (suppliers, infrastructure) your operations rest on.
From the Sekit evidence catalog
Related controls
Via the shared Sekit CSF topic, not the framework's own index.
Ask Sekura: “What evidence proves GV.OC-05?”
Also via MCP, free with account