Supply Chain Risk Management
What is Supply Chain Risk Management?
The process of identifying, assessing, and mitigating risks arising from the extended network of suppliers, vendors, and service providers. Supply chain risk management is addressed by NIST CSF 2.0, ISO 27001 A.5.21, and NIST SP 800-161.
Terms that appear alongside supply chain risk management
Each of these is named in at least one of the same controls as supply chain risk management. The number is how many controls name both.
- nist 12 shared controls
- cybersecurity 9 shared controls
- risk management plan 9 shared controls
- policy 8 shared controls
- integrity 6 shared controls
- audit 6 shared controls
- risk assessment 6 shared controls
- software bill of materials 5 shared controls
Frameworks that govern supply chain risk management
What the standards actually require on supply chain risk management
Requirements naming supply chain risk management across 6 standards, quoted from the control text.
Identify, prioritize, and assess suppliers of critical or mission-essential technologies, products, and services.
NIST800-PM-30(1) · PM-30(1) Supply Chain Risk Management Strategy | Suppliers of Critical or Mission-essential Items →The organisation develops an organisation-wide strategy for managing supply chain risks in the development, acquisition, maintenance and disposal of systems, components and services, implements it consistently, and reviews and updates it at a set frequency or...
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PM-30 · PM-30 Supply chain risk management strategy →Establish a supply chain risk management team of individuals with security and SCRM responsibilities to lead and support SCRM across IT, contracting, information security, privacy, mission, legal, supply chain and logistics, acquisition, business continuity an...
fbi-cjis-security-policy::SR-2(1) · SR-2(1) Supply Chain Risk Management Plan | Establish SCRM Team →Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders. IDENTIFY (ID) Function, Supply Chain Risk Management (ID.SC) Category. Outcome in the Framework Core of Version 1.1;
nist-cybersecurity-framework-1-1::ID.SC-1 · ID.SC-1: Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders →Establish a supply chain risk management team consisting of [Assignment: organization-defined personnel, roles, and responsibilities] to lead and support the following SCRM activities: [Assignment: organization-defined supply chain risk management activities].
nist-sp-800-53-revision-5-1-high::SR-2(1) · SR-2(1) Supply Chain Risk Management Plan | Establish SCRM Team →Establish a supply chain risk management team consisting of [Assignment: organization-defined personnel, roles, and responsibilities] to lead and support the following SCRM activities: [Assignment: organization-defined supply chain risk management activities].
nist-sp-800-53-rev-5-low::SR-2(1) · SR-2(1) Supply Chain Risk Management Plan | Establish SCRM Team →Questions people ask about supply chain risk management
What is Supply Chain Risk Management?
Why is Supply Chain Risk Management important for compliance?
Which compliance frameworks address Supply Chain Risk Management?
Where can I learn more about Supply Chain Risk Management?
See how Supply Chain Risk Management applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.