💼 GV.SC-09: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle

Contextual name: 💼 GV.SC-09: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle
ID: /frameworks/nist-csf-v2.0/gv-sc/09
Located in: 💼 Cybersecurity Supply Chain Risk Management (GV.SC)

Description

Policies and procedures require provenance records for all acquired technology products and services
Periodically provide risk reporting to leaders about how acquired components are proven to be untampered and authentic
Communicate regularly among cybersecurity risk managers and operations personnel about the need to acquire software patches, updates, and upgrades only from authenticated and trustworthy software providers
Review policies to ensure that they require approved supplier personnel to perform maintenance on supplier products
Policies and procedure require checking upgrades to critical hardware for unauthorized changes

Section	Sub Sections	Internal Rules	Policies
💼 NIST CSF v1.1 → 💼 ID.SC-1: Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders
💼 NIST SP 800-53 Revision 5 → 💼 PM-9 Risk Management Strategy
💼 NIST SP 800-53 Revision 5 → 💼 PM-19 Privacy Program Leadership Role
💼 NIST SP 800-53 Revision 5 → 💼 PM-28 Risk Framing
💼 NIST SP 800-53 Revision 5 → 💼 PM-30 Supply Chain Risk Management Strategy	1
💼 NIST SP 800-53 Revision 5 → 💼 PM-31 Continuous Monitoring Strategy
💼 NIST SP 800-53 Revision 5 → 💼 RA-3 Risk Assessment	4
💼 NIST SP 800-53 Revision 5 → 💼 RA-7 Risk Response
💼 NIST SP 800-53 Revision 5 → 💼 SA-4 Acquisition Process	12
💼 NIST SP 800-53 Revision 5 → 💼 SA-9 External System Services	8	1	1
💼 NIST SP 800-53 Revision 5 → 💼 SR-2 Supply Chain Risk Management Plan	1
💼 NIST SP 800-53 Revision 5 → 💼 SR-3 Supply Chain Controls and Processes	3
💼 NIST SP 800-53 Revision 5 → 💼 SR-5 Acquisition Strategies, Tools, and Methods	2
💼 NIST SP 800-53 Revision 5 → 💼 SR-6 Supplier Assessments and Reviews	1

Section	Sub Sections	Internal Rules	Policies	Flags