SekitCrosswalk
ENES
Start free trial
NIST CSF 2.0 · derived mapping target

GV.SC-01Supply chain risk program established

Stand up a supply chain risk management program with agreed strategy, objectives, and processes, signed off by leadership. Make third-party risk a managed discipline.

Mapping at a glance
GV.SC-01Supply chain risk program establishedNIST CSF 2.0
RCF-0025Third-party risk managementGovernance & Risk · PolicyRCF-0026Third-party risk managementGovernance & Risk · ProcessRCF-0027Third-party risk managementGovernance & Risk · TechnicalRCF-0316Vendor due diligenceSupply Chain Security · PolicyRCF-0317Vendor due diligenceSupply Chain Security · Process

GV.SC-01 is covered by 9 Sekit CSF controls. +4 more in the table below. Open in the full graph →

Mapped from the Sekit CSF

The Sekit controls that cover this requirement, lens by lens.

RCF-0025Third-party risk management · PolicyRCF-0026Third-party risk management · ProcessRCF-0027Third-party risk management · TechnicalRCF-0316Vendor due diligence · PolicyRCF-0317Vendor due diligence · ProcessRCF-0318Vendor due diligence · TechnicalRCF-0331Shared responsibility model · PolicyRCF-0332Shared responsibility model · ProcessRCF-0333Shared responsibility model · Technical

ISO/IEC 27001:2022 · Annex A controls counterparts

Reached through the Sekit CSF controls both map to — a mapping, not a formal equivalence.

A.5.22 Monitoring, review and change management of supplier servicesA.5.19 Information security in supplier relationshipsA.5.23 Information security for use of cloud servicesA.5.21 Managing information security in the ICT supply chainA.8.16 Monitoring activitiesA.8.9 Configuration managementA.8.15 LoggingA.5.18 Access rightsA.5.20 Addressing information security within supplier agreementsA.8.30 Outsourced development

ISO/IEC 42001:2023 — Annex A counterparts

A.10.3 SuppliersA.7.3 Acquisition of dataA.10.2 Allocation of responsibilities

Cyber Essentials counterparts

CE2.1 Remove unnecessary accounts and softwareCE2.2 Change default and guessable passwords

Evidence that proves this control

What an auditor, or Sekit's evidence engine, asks for.

Vendor due diligence and monitoring
How the company assesses a supplier's security before hiring and monitors it during the relationship, including the process when it ends.
From the Sekit evidence catalog

Related controls

Via the shared Sekit CSF topic, not the framework's own index.

GV.OC-04 Critical objectives and services understoodGV.SC-02 Supplier roles and responsibilities establishedGV.SC-03 Supply chain risk integratedGV.SC-04 Suppliers known and prioritizedGV.SC-05 Supply chain requirements in contractsGV.SC-06 Due diligence before engagementGV.SC-07 Supplier risk managed over relationshipGV.SC-08 Suppliers in incident planning
Ask Sekura: “What evidence proves GV.SC-01?”
Connect your AI · free MCP
https://sekit.ai/api/mcp/crosswalk
  1. In Claude or ChatGPT, add a custom connector and paste this URL.
  2. Sign in with your email to finish. Free, read-only, no organization required.