GV.SC-04 says suppliers are known and prioritized by criticality. You need a complete list of who you buy from and a ranking that tells you which ones can hurt you most. Without the list you cannot review anyone, and without the ranking you review everyone equally and no one well.
What good looks like
A single supplier inventory owned by one person, built from finance, procurement and IT records, not from memory. Each supplier has a tier based on written criteria. Tier one suppliers get deeper reviews and closer monitoring. The list is updated when a new tool is bought and when one is dropped.
NIST's examples ask for two things: criteria for supplier criticality, such as the sensitivity of data processed, the degree of access to your systems and the importance to your mission, and a record of all suppliers prioritized against those criteria.
How to implement it
- Build the list. Start with accounts payable, then corporate card statements, then the identity provider's list of connected apps, then cloud accounts and code repositories. Shadow tools show up in the card statements and single sign on logs.
- Capture basics per supplier: what they provide, which team owns the relationship, what data they touch, what access they have, contract renewal date and security contact.
- Define criticality criteria. Three questions are enough: how sensitive is the data they handle, how deep is their access to your systems, and how badly would the business suffer if they failed.
- Assign tiers. A simple three tier model works: critical, important, low. Record the reasoning.
- Link tiers to actions: tier one gets a full due diligence review before purchase and an annual review after, tier two gets a lighter questionnaire, tier three gets a basic check.
- Keep it current. Add a purchasing gate so no new tool is paid for without being logged, and reconcile against finance data twice a year.
- Include software suppliers. Open source projects and package registries that feed your builds are suppliers too, even though you pay nothing.
Evidence to collect
- The supplier inventory with owners, data and access fields.
- The written criticality criteria and the tier for each supplier.
- The purchasing gate procedure and a sample of it applied.
- Reconciliation records against finance or single sign on data.
Common gaps
- The list comes from procurement alone and misses tools bought on a team card.
- Everything is rated critical, which defeats the purpose.
- Tiering is done once and never revisited as data access grows.
- Open source and subprocessors are absent.
- No owner, so renewals pass without review.
Reviewing the critical tier
Once the tiers exist, put your effort where it counts. The demo shows a vendor risk review: gathering a supplier's documents, scoring the answers and recording a decision. Run that for your tier one list first.
A minimal inventory template
Columns that earn their place: supplier name, service provided, business owner, data types handled, level of system access, tier, contract end date, last review date, next review date, security contact. Ten columns, one row per supplier, maintained by one owner. Add a column for subprocessors if you have tier one suppliers that pass data on, since your risk includes them.
Keeping up with change
Suppliers change ownership, change hosting and get breached. Subscribe to security advisories and status pages for your tier one suppliers, and set a reminder to re-tier a supplier when its access or data handling grows. A supplier that began as a design tool and now connects to your customer database is no longer low risk.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
How many tiers should we use?
Three is enough for most companies. More tiers add effort without changing what you do.
How do we find suppliers nobody told us about?
Check corporate card statements, accounts payable, and the list of third party apps connected to your identity provider and code hosting.
Sources
- NIST Cybersecurity Framework 2.0 Reference Tool, subcategory GV.SC-04: https://csrc.nist.gov/projects/cybersecurity-framework/filters
- NIST Cybersecurity Framework overview: https://www.nist.gov/cyberframework
The CSF is voluntary guidance. There is no CSF certification, so this post describes how to work toward the outcome, not how to pass an audit.
