Knowledge is Power
BARE METAL CYBERKnowledge is Power

Sitewide Search

Search Bare Metal Cyber

Search exact control and technique identifiers, Cyber Wiki articles, framework records, playbooks, books, podcasts, Academy courses, individual lessons, and BMC Cyber Challenge activities.

NIST CSF Category profileIntermediate

Cybersecurity Supply Chain Risk Management (GV.SC) — NIST CSF 2.0 Category

Use GV.SC to manage supplier criticality, requirements, due diligence, monitoring, incident coordination, and life-cycle risk within the Govern Function.

Framework mapping

NIST Cybersecurity Framework 2.0

CSF 2.0
CategoryGV.SC — Cybersecurity Supply Chain Risk Management
FunctionGV — GovernCategoryGV.SC — Cybersecurity Supply Chain Risk Management
Official CSF Core outcome

Cyber supply chain risk management processes are identified, established, managed, monitored, and improved by organizational stakeholders.

CSF outcomes describe what an organization may seek to achieve. They do not prescribe one implementation or turn the Core into a universal checklist.

Category outcome

NIST CSF 2.0 places Cybersecurity Supply Chain Risk Management (GV.SC) within the Govern Function. The official Category outcome is: “Cyber supply chain risk management processes are identified, established, managed, monitored, and improved by organizational stakeholders.”

This Category provides a structured way to address supplier criticality, requirements, due diligence, monitoring, incident coordination, and life-cycle risk. It groups related Subcategory outcomes without prescribing a specific technology, organizational model, or implementation sequence.

What this means in practice

A credible Cybersecurity Supply Chain Risk Management capability connects policy and risk decisions to repeatable operating practices. The organization should define scope, ownership, expected outcomes, evidence, exceptions, and reassessment triggers.

Implementation should be proportionate to mission needs, legal and contractual obligations, threat exposure, business impact, and the organization’s risk appetite. The same Category may be implemented differently across systems and business contexts.

Implementation priorities

The following priorities translate the Category into an operating capability. They are starting points for design and governance, not a replacement for architecture, procedures, or risk analysis.

  • Establish a supply chain risk management program with executive sponsorship.
  • Prioritize suppliers, services, and technology components by criticality and concentration risk.
  • Include cybersecurity requirements and responsibilities in agreements.
  • Perform proportionate due diligence before acquisition and throughout the relationship.
  • Coordinate incident, continuity, and post-relationship activities with relevant third parties.

Evidence and measurement

Evidence should show that the Category’s outcomes are achieved in the intended scope, remain effective, and are reviewed when conditions change. A policy, tool purchase, or completed checklist is not sufficient by itself.

  • Supplier inventory and criticality tiers
  • Due diligence and risk assessment records
  • Contract clauses, service requirements, and security addenda
  • Continuous monitoring, review, and issue-remediation records
  • Supplier incident exercises and offboarding evidence

Subcategories within GV.SC

This Category contains 10 CSF 2.0 Subcategory outcomes. Each outcome has a dedicated Bare Metal Cyber profile with the official NIST statement and original implementation guidance.

  • GV.SC-01 — C-SCRM Program and Strategy: A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders
  • GV.SC-02 — Supply Chain Roles and Responsibilities: Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally
  • GV.SC-03 — Integrate C-SCRM with Risk Management: Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes
  • GV.SC-04 — Prioritize Suppliers by Criticality: Suppliers are known and prioritized by criticality
  • GV.SC-05 — Supply Chain Requirements in Agreements: Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
  • GV.SC-06 — Supplier Due Diligence: Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships
  • GV.SC-07 — Monitor Supplier and Third-Party Risk: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship
  • GV.SC-08 — Include Suppliers in Incident Activities: Relevant suppliers and other third parties are included in incident planning, response, and recovery activities
  • GV.SC-09 — Life-Cycle Supply Chain Security: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle
  • GV.SC-10 — Post-Relationship Supply Chain Provisions: Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement

Using this Category in Current and Target Profiles

For a Current Profile, record which Subcategory outcomes are achieved, the scope of the assessment, and the evidence supporting the judgment. For a Target Profile, select the outcomes needed to meet risk management objectives and describe the target conditions.

Prioritize the resulting gaps by mission consequence, risk exposure, dependencies, obligations, implementation effort, and the value of the improvement. Record the owner and the evidence that will demonstrate closure.

Common failure modes

The following conditions can create the appearance of coverage without reliable outcome achievement. Treat them as hypotheses to test during assessments, exercises, and operational reviews.

  • All suppliers receive the same questionnaire regardless of criticality.
  • Contracts contain requirements that are not monitored or enforceable.
  • Fourth-party and concentration dependencies remain invisible.
  • Supplier access and data persist after the relationship ends.

Source, scope, and attribution

The Category identifier, name, description, and Subcategory outcomes are from NIST CSWP 29. Bare Metal Cyber’s implementation, evidence, failure-mode, and Profile guidance is original educational material.

The CSF describes outcomes, not mandatory implementation steps. Use NIST’s current online Implementation Examples and Informative References when selecting practices and controls for a specific environment.

Certification relevance

This subject appears in or supports the following certification bodies of knowledge:

NIST CSF 2.0ISC2 CISSPISACA CRISCISC2 CGRC

Authoritative sources