NIST CSF 2.0 · derived mapping target
GV.SC-03Supply chain risk integrated
Fold supply chain risk into your wider cyber and enterprise risk processes, including assessments and improvement work, rather than handling it in isolation.
Mapping at a glance
GV.SC-03Supply chain risk integratedNIST CSF 2.0
RCF-0025Third-party risk managementGovernance & Risk · PolicyRCF-0026Third-party risk managementGovernance & Risk · ProcessRCF-0027Third-party risk managementGovernance & Risk · TechnicalRCF-0316Vendor due diligenceSupply Chain Security · PolicyRCF-0317Vendor due diligenceSupply Chain Security · Process
GV.SC-03 is covered by 9 Sekit CSF controls. +4 more in the table below. Open in the full graph →
Mapped from the Sekit CSF
The Sekit controls that cover this requirement, lens by lens.
RCF-0025Third-party risk management · PolicyRCF-0026Third-party risk management · ProcessRCF-0027Third-party risk management · TechnicalRCF-0316Vendor due diligence · PolicyRCF-0317Vendor due diligence · ProcessRCF-0318Vendor due diligence · TechnicalRCF-0319Contractual security clauses · PolicyRCF-0320Contractual security clauses · ProcessRCF-0321Contractual security clauses · Technical
ISO/IEC 27001:2022 counterparts
Reached through the Sekit CSF controls both map to — a mapping, not a formal equivalence.
ISO/IEC 42001:2023 — Annex A counterparts
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
Risk assessment and treatment plan
The record where the company identifies its security risks and decides what to do with each one (accept, reduce or transfer), with owners and deadlines.
Vendor due diligence and monitoring
How the company assesses a supplier's security before hiring and monitors it during the relationship, including the process when it ends.
From the Sekit evidence catalog
Related controls
Via the shared Sekit CSF topic, not the framework's own index.
Ask Sekura: “What evidence proves GV.SC-03?”
Also via MCP, free with account