GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties.
5
artefacts
1
held by a system
1
at each review
hard
to go live
Vendor register / contract repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Negotiation log capturing accepted deviations · SIEM / log platform
periodic reviewEvidence produced at each review
- Contract management workflow with security review gate · Vendor register / contract repository
governing documentDocuments that govern the control
- Standard supplier security requirements catalog · Vendor register / contract repository
- Contract clause library with cyber obligations · Vendor register / contract repository
- Requirements tailoring guide by supplier tier · Vendor register / contract repository
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your SIEM / log platform on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Requirements not enforced in long term contracts
- Deviations approved without risk acceptance
- Clauses lack audit and notification provisions
- Renewals not re assessed against current standard
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetGV.SC-04 Suppliers are known and prioritized by criticality · GV.SC-06 Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships