SekitCrosswalk
ENES
Start now
NIST CSF 2.0 · derived mapping target

GV.SC-07Supplier risk managed over relationship

Assess, record, and monitor each significant supplier's risk throughout the relationship, and respond as their risk profile changes. Vendor risk is not a one-time check.

Mapping at a glance
GV.SC-07Supplier risk managed over relationshipNIST CSF 2.0
RCF-0025Third-party risk managementGovernance & Risk · PolicyRCF-0026Third-party risk managementGovernance & Risk · ProcessRCF-0027Third-party risk managementGovernance & Risk · TechnicalRCF-0295Supply chain continuityBusiness Continuity · PolicyRCF-0296Supply chain continuityBusiness Continuity · Process

GV.SC-07 is covered by 12 Sekit CSF controls. +7 more in the table below. Open in the full graph →

Mapped from the Sekit CSF

The Sekit controls that cover this requirement, lens by lens.

RCF-0025Third-party risk management · PolicyRCF-0026Third-party risk management · ProcessRCF-0027Third-party risk management · TechnicalRCF-0295Supply chain continuity · PolicyRCF-0296Supply chain continuity · ProcessRCF-0297Supply chain continuity · TechnicalRCF-0322Ongoing monitoring · PolicyRCF-0323Ongoing monitoring · ProcessRCF-0324Ongoing monitoring · TechnicalRCF-0325Offboarding vendors · PolicyRCF-0326Offboarding vendors · ProcessRCF-0327Offboarding vendors · Technical

ISO/IEC 27001:2022 counterparts

Reached through the Sekit CSF controls both map to — a mapping, not a formal equivalence.

A.5.22 Monitoring, review and change management of supplier servicesA.5.19 Information security in supplier relationshipsA.5.18 Access rightsA.5.21 Managing information security in the ICT supply chainA.8.16 Monitoring activitiesA.5.7 Threat intelligenceA.5.20 Addressing information security within supplier agreementsA.8.15 LoggingA.5.29 Information security during disruptionA.5.16 Identity management

ISO/IEC 42001:2023 — Annex A counterparts

A.10.3 SuppliersA.7.3 Acquisition of data

Cyber Essentials counterparts

CE4.1 Manage the account lifecycle

Evidence that proves this control

What an auditor, or Sekit's evidence engine, asks for.

Vendor due diligence and monitoring
How the company assesses a supplier's security before hiring and monitors it during the relationship, including the process when it ends.
From the Sekit evidence catalog

Related controls

Via the shared Sekit CSF topic, not the framework's own index.

DE.CM-06 External provider activity monitoredGV.SC-01 Supply chain risk program establishedGV.SC-02 Supplier roles and responsibilities establishedGV.SC-03 Supply chain risk integratedGV.SC-04 Suppliers known and prioritizedGV.SC-05 Supply chain requirements in contractsGV.SC-06 Due diligence before engagementGV.SC-08 Suppliers in incident planning
Ask Sekura: “What evidence proves GV.SC-07?”
Also via MCP, free with account