SekitCrosswalk
ENES
Start now
NIST CSF 2.0 · derived mapping target

GV.SC-06Due diligence before engagement

Do planning and due diligence before signing with a supplier so you reduce known risks before the relationship begins, not after.

Mapping at a glance
GV.SC-06Due diligence before engagementNIST CSF 2.0
RCF-0025Third-party risk managementGovernance & Risk · PolicyRCF-0026Third-party risk managementGovernance & Risk · ProcessRCF-0027Third-party risk managementGovernance & Risk · TechnicalRCF-0127Dependency/SBOM managementApplication Security · PolicyRCF-0128Dependency/SBOM managementApplication Security · Process

GV.SC-06 is covered by 21 Sekit CSF controls. +16 more in the table below. Open in the full graph →

Mapped from the Sekit CSF

The Sekit controls that cover this requirement, lens by lens.

RCF-0025Third-party risk management · PolicyRCF-0026Third-party risk management · ProcessRCF-0027Third-party risk management · TechnicalRCF-0127Dependency/SBOM management · PolicyRCF-0128Dependency/SBOM management · ProcessRCF-0129Dependency/SBOM management · TechnicalRCF-0316Vendor due diligence · PolicyRCF-0317Vendor due diligence · ProcessRCF-0318Vendor due diligence · TechnicalRCF-0319Contractual security clauses · PolicyRCF-0320Contractual security clauses · ProcessRCF-0321Contractual security clauses · TechnicalRCF-0322Ongoing monitoring · PolicyRCF-0323Ongoing monitoring · ProcessRCF-0324Ongoing monitoring · TechnicalRCF-0328Software supply chain (SBOM) · PolicyRCF-0329Software supply chain (SBOM) · ProcessRCF-0330Software supply chain (SBOM) · TechnicalRCF-0370Cross-border transfers · PolicyRCF-0371Cross-border transfers · ProcessRCF-0372Cross-border transfers · Technical

ISO/IEC 27001:2022 counterparts

Reached through the Sekit CSF controls both map to — a mapping, not a formal equivalence.

A.5.22 Monitoring, review and change management of supplier servicesA.5.19 Information security in supplier relationshipsA.8.8 Management of technical vulnerabilitiesA.5.21 Managing information security in the ICT supply chainA.5.20 Addressing information security within supplier agreementsA.5.9 Inventory of information and other associated assetsA.5.34 Privacy and protection of personal identifiable information (PII)A.5.14 Information transferA.5.7 Threat intelligenceA.8.30 Outsourced developmentA.8.16 Monitoring activitiesA.5.1 Policies for information securityA.8.15 LoggingA.8.24 Use of cryptographyA.5.18 Access rightsA.8.29 Security testing in development and acceptance

ISO/IEC 42001:2023 — Annex A counterparts

A.10.3 SuppliersA.7.3 Acquisition of data

Cyber Essentials counterparts

CE3.2 Apply critical updates within 14 daysCE3.1 Use licensed and supported software

Evidence that proves this control

What an auditor, or Sekit's evidence engine, asks for.

Vendor due diligence and monitoring
How the company assesses a supplier's security before hiring and monitors it during the relationship, including the process when it ends.
From the Sekit evidence catalog

Related controls

Via the shared Sekit CSF topic, not the framework's own index.

DE.CM-06 External provider activity monitoredGV.OC-03 Legal and regulatory requirements understoodGV.SC-01 Supply chain risk program establishedGV.SC-02 Supplier roles and responsibilities establishedGV.SC-03 Supply chain risk integratedGV.SC-04 Suppliers known and prioritizedGV.SC-05 Supply chain requirements in contractsGV.SC-07 Supplier risk managed over relationship
Ask Sekura: “What evidence proves GV.SC-06?”
Also via MCP, free with account