NIST CSF 2.0 · derived mapping target
GV.SC-08Suppliers in incident planning
Include relevant suppliers and partners in your incident planning, response, and recovery so a shared incident does not catch either side unprepared.
Mapping at a glance
GV.SC-08Suppliers in incident planningNIST CSF 2.0
RCF-0025Third-party risk managementGovernance & Risk · PolicyRCF-0026Third-party risk managementGovernance & Risk · ProcessRCF-0027Third-party risk managementGovernance & Risk · TechnicalRCF-0325Offboarding vendorsSupply Chain Security · PolicyRCF-0326Offboarding vendorsSupply Chain Security · Process
GV.SC-08 is covered by 6 Sekit CSF controls. +1 more in the table below. Open in the full graph →
Mapped from the Sekit CSF
The Sekit controls that cover this requirement, lens by lens.
RCF-0025Third-party risk management · PolicyRCF-0026Third-party risk management · ProcessRCF-0027Third-party risk management · TechnicalRCF-0325Offboarding vendors · PolicyRCF-0326Offboarding vendors · ProcessRCF-0327Offboarding vendors · Technical
ISO/IEC 27001:2022 counterparts
Reached through the Sekit CSF controls both map to — a mapping, not a formal equivalence.
ISO/IEC 42001:2023 — Annex A counterparts
Cyber Essentials counterparts
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
Incident response plan
The plan defining how the company acts when a security incident occurs: who does what, who is notified, and within what timeframes.
Vendor due diligence and monitoring
How the company assesses a supplier's security before hiring and monitors it during the relationship, including the process when it ends.
From the Sekit evidence catalog
Related controls
Via the shared Sekit CSF topic, not the framework's own index.
Ask Sekura: “What evidence proves GV.SC-08?”
Also via MCP, free with account