GV.SC-08 says relevant suppliers and other third parties are included in incident planning, response, and recovery. The test is simple: if your payment processor or cloud host has a breach tonight, do you know who contacts whom, and by when?
CSF is voluntary guidance and there is no CSF certification.
What good looks like
Your incident plan names the critical suppliers, lists a security contact at each, and states the reporting window you expect. Supplier contracts say they must tell you about incidents affecting your data. At least one exercise a year includes a supplier.
How to implement it
- Pick the five or ten suppliers whose failure would trigger your incident plan.
- For each, record an incident contact, an escalation path and the notice period in the contract.
- Write down roles: who at your company talks to the supplier, who talks to customers, who decides.
- Agree a channel that works when email is down, such as a phone bridge.
- Include one supplier in a tabletop exercise and hold a lessons learned session afterward.
A worked example
A company relies on a hosted database provider. The incident plan lists the provider's security contact, the support escalation phone number, and the contract term that requires notice within seventy two hours of a confirmed incident. During a tabletop exercise the team simulates a provider notice that customer records may have been exposed. They discover that the contact on file left the provider a year ago and that nobody on their side owns customer communication. Both gaps are fixed within a week, long before a real event.
Evidence to collect
- The contact and escalation list, with a review date.
- Contract clauses on incident notification.
- Tabletop notes that show a supplier took part.
- Lessons learned actions with owners.
Common gaps
- The supplier contact is a generic support address.
- Notification terms are missing or say "promptly" with no number.
- Suppliers are never invited to exercises, so the first joint run is a real incident.
Quick check
Do all suppliers need to be included?
No. The outcome says relevant suppliers. Start with the ones whose compromise would touch your data or stop your service.
Sources
- NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
