Sekit CSF · Supply Chain Security · Process
RCF-0317Vendor due diligence
Security assessments are consistently conducted at onboarding and reviewed periodically throughout the relationship
Mapping at a glance
RCF-0317Vendor due diligenceSupply Chain Security · Process
A.5.19Information security in supplier relationshipsISO/IEC 27001:2022A.5.22Monitoring, review and change management of supplier servicesISO/IEC 27001:2022GV.SC-01Supply chain risk program establishedNIST CSF 2.0GV.SC-03Supply chain risk integratedNIST CSF 2.0GV.SC-04Suppliers known and prioritizedNIST CSF 2.0
RCF-0317 maps to 7 controls across the published frameworks. +2 more in the table below. Open in the full graph →
Maps to ISO/IEC 27001:2022
Curated mapping with the reasoning, not just the codes.
A.5.19Information security in supplier relationshipssupportsRunning the security assessment at onboarding and repeating it on a cycle is what makes A.5.19's risk requirement operate rather than sit as a policy line.A.5.22Monitoring, review and change management of supplier servicessupportsRepeating the supplier security assessment on a defined cycle during the relationship is A.5.22's review requirement applied to security posture rather than availability.
Maps to NIST CSF 2.0
Curated mapping with the reasoning, not just the codes.
GV.SC-01Supply chain risk program establishedGV.SC-03Supply chain risk integratedGV.SC-04Suppliers known and prioritizedGV.SC-06Due diligence before engagement
Maps to ISO/IEC 42001:2023 — Annex A
Curated mapping with the reasoning, not just the codes.
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
Vendor due diligence and monitoring
How the company assesses a supplier's security before hiring and monitors it during the relationship, including the process when it ends.
From the Sekit evidence catalog
This topic through the other lenses
All Supply Chain Security controls
Ask Sekura: “What evidence proves RCF-0317?”
Also via MCP, free with account