SekitCrosswalk
ENES
Start now
NIST CSF 2.0 · derived mapping target

GV.SC-05Supply chain requirements in contracts

Build clear cybersecurity requirements into supplier contracts and agreements, prioritized by risk, so expectations are enforceable rather than assumed.

Mapping at a glance
GV.SC-05Supply chain requirements in contractsNIST CSF 2.0
RCF-0025Third-party risk managementGovernance & Risk · PolicyRCF-0026Third-party risk managementGovernance & Risk · ProcessRCF-0027Third-party risk managementGovernance & Risk · TechnicalRCF-0331Shared responsibility modelCloud Security · PolicyRCF-0332Shared responsibility modelCloud Security · Process

GV.SC-05 is covered by 9 Sekit CSF controls. +4 more in the table below. Open in the full graph →

Mapped from the Sekit CSF

The Sekit controls that cover this requirement, lens by lens.

RCF-0025Third-party risk management · PolicyRCF-0026Third-party risk management · ProcessRCF-0027Third-party risk management · TechnicalRCF-0331Shared responsibility model · PolicyRCF-0332Shared responsibility model · ProcessRCF-0333Shared responsibility model · TechnicalRCF-0370Cross-border transfers · PolicyRCF-0371Cross-border transfers · ProcessRCF-0372Cross-border transfers · Technical

ISO/IEC 27001:2022 counterparts

Reached through the Sekit CSF controls both map to — a mapping, not a formal equivalence.

A.5.34 Privacy and protection of personal identifiable information (PII)A.5.22 Monitoring, review and change management of supplier servicesA.5.14 Information transferA.5.23 Information security for use of cloud servicesA.5.19 Information security in supplier relationshipsA.8.16 Monitoring activitiesA.8.9 Configuration managementA.8.15 LoggingA.8.24 Use of cryptographyA.5.18 Access rightsA.5.21 Managing information security in the ICT supply chainA.5.20 Addressing information security within supplier agreements

ISO/IEC 42001:2023 — Annex A counterparts

A.7.3 Acquisition of dataA.10.2 Allocation of responsibilities

Cyber Essentials counterparts

CE2.1 Remove unnecessary accounts and softwareCE2.2 Change default and guessable passwords

Related controls

Via the shared Sekit CSF topic, not the framework's own index.

GV.OC-03 Legal and regulatory requirements understoodGV.OC-04 Critical objectives and services understoodGV.SC-01 Supply chain risk program establishedGV.SC-02 Supplier roles and responsibilities establishedGV.SC-03 Supply chain risk integratedGV.SC-04 Suppliers known and prioritizedGV.SC-06 Due diligence before engagementGV.SC-07 Supplier risk managed over relationship
Ask Sekura: “What evidence proves GV.SC-05?”
Also via MCP, free with account