GV.SC-03 says cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment and improvement processes. Supplier risk should not live in a separate folder. It should show up in the same register, the same assessments and the same improvement cycle as everything else.
What good looks like
Supplier risks appear on the company risk register with the same scoring scale. Control sets for cybersecurity and for supply chain risk are combined, so a requirement about access control covers staff and suppliers alike. Lessons from supplier incidents feed the improvement process. Serious supply chain risks are escalated to senior management and handled at the enterprise risk level.
How to implement it
- Find the overlaps. Many controls, such as access management, logging and incident response, apply to both your own systems and those of suppliers.
- Build one integrated control set. Mark which controls you operate yourself and which you require of suppliers.
- Put supplier risks into the main register (see GV.RM-03 and GV.RM-06) using the same scoring and categories.
- Feed improvements in. After a supplier incident or a failed review, record what changes in policy, contract language or monitoring.
- Define escalation. Material supply chain risks go to senior management and enterprise risk discussions on a defined timeline.
- Watch for change. Suppliers update, merge and get breached. Monitoring keeps the register current between reviews.
Evidence to collect
- The integrated control set or a mapping showing shared controls.
- Register entries for supplier risks with owners and scores.
- Records of improvements made after supplier events.
- Escalation records with dates and decisions.
Common gaps
- A vendor risk spreadsheet exists in procurement and never reaches the company register.
- Supplier reviews happen at onboarding only, with no later monitoring.
- A supplier breach produces a message to customers and no internal improvement.
- Escalation criteria are undefined, so serious findings sit with a mid level owner.
Monitoring between reviews
Annual reviews miss what happens in between. Continuous monitoring watches for changes such as new vulnerabilities in the components you ship, a supplier trust page that drops a report, or a breach disclosure. The demo shows how monitoring signals feed back into risk records so the register stays current.
Sample escalation rule
A written rule might say: any supplier risk scored in the top band, any supplier breach affecting data we hold, and any critical supplier that fails a review goes to the executive team within five business days. The executive team then decides to accept with conditions, require remediation by a date, or begin a switch. Recording the decision in the main risk register closes the loop between supplier management and enterprise risk.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do we need a separate supply chain register?
No. Supplier risks are best kept in the main risk register with a category label, so leaders can compare them with other risks.
What counts as a material supply chain risk?
A supplier or component whose failure or compromise would hit a critical service or sensitive data. Define the threshold in your escalation criteria.
Sources
- NIST Cybersecurity Framework 2.0 Reference Tool, subcategory GV.SC-03: https://csrc.nist.gov/projects/cybersecurity-framework/filters
- NIST Cybersecurity Framework overview: https://www.nist.gov/cyberframework
The CSF is voluntary guidance. There is no CSF certification, so this post describes how to work toward the outcome, not how to pass an audit.
