GV.SC-01 says a cybersecurity supply chain risk management program, strategy, objectives, policies and processes are established and agreed to by organizational stakeholders. You need a deliberate program for the risk that comes from suppliers, software you buy or download, and services you rely on, owned and agreed across the company.
What good looks like
A short strategy states what the program is for: for example, to know our critical suppliers, to require security terms in their contracts and to react quickly when one is compromised. A plan with milestones turns that into work. Policies and procedures exist, are shared with the people who use them, and are followed. Cybersecurity, IT, operations, legal, HR and engineering have a way of staying aligned.
How to implement it
- Write the strategy and objectives. Keep it to a page. Tie each objective to a risk you actually carry, such as a supplier with access to customer data or a dependency in your core product.
- Build the program plan. List milestones across the next twelve months: supplier inventory, criticality tiers, contract language, due diligence process, monitoring, incident handling for supplier events. Assign owners and dates.
- Draft the policies and procedures. A supplier risk policy, a procurement security checklist, an onboarding and offboarding process for vendors, and an open source and software component policy.
- Share them with stakeholders. Procurement, legal, engineering and the business owners who pick tools need to know the rules before they sign.
- Create a cross functional mechanism. A monthly or quarterly working group with security, IT, legal, procurement and an engineering representative works for most companies.
- Get agreement. Leaders approve the strategy and plan, and the approval is recorded.
- Run the processes, measure them, and improve the program as you learn.
Evidence to collect
- The strategy document with approval and date.
- The program plan with milestones and progress.
- Policies and procedures with version history and communication records.
- Working group agendas and minutes.
- Samples of the process in use, such as a completed supplier review.
Common gaps
- A supplier policy exists but no one owns it or runs it.
- Procurement signs contracts without involving security.
- Engineering adds open source packages and cloud services freely, outside the program.
- Only the largest vendors are tracked, and the smaller ones with real data access are missed.
- No milestones, so the program never advances past the policy.
Start small
You do not need a full program on day one. A workable first quarter: list your suppliers, tier them into critical and not, write a one page policy, and add a security checklist to purchasing. Later quarters add contract language, monitoring and incident handling. The strategy tells you where you are heading, and the plan keeps the work moving.
Software is part of the supply chain
Many small companies focus on vendors and miss the code they ship. Open source dependencies, build tools and container base images are suppliers too. Include them in the program: keep an inventory of components, set rules for adding new ones and monitor them for known vulnerabilities. The free in-browser dependency scan at https://gold.safeguard.sh/scan is a quick way to see where you stand before you write the policy.
What a twelve month plan can look like
Quarter one: build the supplier inventory, define criticality criteria and tier the list, and publish a one page policy. Quarter two: add security terms to the standard contract, build the due diligence checklist and run reviews for tier one suppliers. Quarter three: set up monitoring for critical suppliers and software components, and run a tabletop where a key supplier reports a breach. Quarter four: review results with leadership, retire what did not work and plan next year.
Each quarter has an owner and a deliverable that produces evidence. That is what separates a program from a policy.
Quick check
Who should own the program?
One named person, often the head of security or IT, with authority to require reviews. The working group supports them but does not replace the owner.
How big does the program need to be?
Proportionate to your risk. A page of strategy, a plan with milestones and a working process can meet the outcome in a small company.
Sources
- NIST Cybersecurity Framework 2.0 Reference Tool, subcategory GV.SC-01: https://csrc.nist.gov/projects/cybersecurity-framework/filters
- NIST Cybersecurity Framework overview: https://www.nist.gov/cyberframework
The CSF is voluntary guidance. There is no CSF certification, so this post describes how to work toward the outcome, not how to pass an audit.
