NIST CSF 2.0 GV.SC-02: Assign Supply Chain Risk Roles

GV.SC-02 says cybersecurity roles and responsibilities for suppliers, customers and partners are established, communicated and coordinated internally and externally. Someone inside owns supply chain risk, and everyone knows what suppliers and partners must do in return.

What good looks like

Specific roles are accountable for planning, resourcing and running supplier risk work. A responsibility matrix covers who reviews, who approves, who monitors and who handles a supplier incident. Contracts or onboarding documents tell suppliers what is expected of them. Responsibilities appear in job descriptions and have performance goals.

How to implement it

1. Pick the accountable roles for planning, resourcing and execution of supplier risk activities.
2. Document the roles in policy, as NIST suggests.
3. Build a matrix with responsible, accountable, consulted and informed parties for each activity, including legal, procurement and business owners.
4. Add duties to job descriptions and set goals measured periodically.
5. Tell suppliers and partners what their responsibilities are and who to contact. Ask for their named security contact in return.

Evidence to collect

• The responsibility matrix and policy extract.
• Job descriptions with supply chain duties.
• Supplier onboarding materials listing responsibilities and contacts.

Common gaps

• Procurement assumes security is reviewing, and security assumes procurement is.
• Suppliers do not know who to call during an incident.
• Customers and partners are left out, even though they hold part of the shared responsibility.

Quick check

Sources

• NIST Cybersecurity Framework 2.0 Reference Tool, subcategory GV.SC-02: https://csrc.nist.gov/projects/cybersecurity-framework/filters
• NIST Cybersecurity Framework overview: https://www.nist.gov/cyberframework

The CSF is voluntary guidance. There is no CSF certification, so this post describes how to work toward the outcome, not how to pass an audit.