ID.RA-10 says critical suppliers are assessed prior to acquisition. The timing is the point: the review happens before the contract is signed or the data is shared, not a year after. Start by deciding which suppliers are critical, then run a proportionate review on each before onboarding.
What good looks like
A short criteria list defines "critical": touches customer data, has production access, or would stop you operating if it failed. New critical suppliers do not go live until someone has looked at their security posture. NIST's example is to conduct supplier risk assessments against business and applicable cybersecurity requirements, including the supply chain.
How to implement it
- Ask what the supplier will touch and what happens if they are down or breached.
- Request what they already have: a security summary, audit reports, a penetration test summary, and their subprocessor list.
- Ask about incident notification time, data location, and how they handle vulnerability reports.
- Score the result and record any gaps with a plan or a compensating control.
- Get sign off from the business owner before purchase.
- Put the security terms into the contract and set a review date.
Evidence to collect
- The criticality criteria and a supplier list tagged by tier
- Completed assessments dated before the contract start
- Signed approvals and contract security terms
Common gaps
- Assessments happen after go live
- Every supplier gets the same long questionnaire, so the critical ones get a shallow review
- Fourth parties, the suppliers of your suppliers, are never asked about
Quick check
Does a supplier's SOC 2 report end the review?
No. It is useful evidence. You still check scope, exceptions, and whether it covers the service you will use.
Sources
- NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (February 2024), Appendix A, CSF Core: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
- NIST CSF 2.0 landing page: https://csrc.nist.gov/pubs/cswp/29/the-nist-cybersecurity-framework-csf-20/final
The CSF is voluntary guidance. There is no CSF certification, so nothing here makes a company "CSF certified". You describe your own practices against the outcomes.
