gv-sc-07-gvsc-07

name	GV.SC-07_gvsc-07
description	The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and
category	configuration
version	2.0
author	cyberstrike-official
tags	["nist","csf","v2.0","gv-sc-07","gv","subcategory"]
tech_stack	["any"]
cwe_ids	[]
chains_with	[]
prerequisites	["Cybersecurity Supply Chain Risk Management (GV.SC)"]
severity_boost	{}

GV.SC-07 GV.SC-07

Subcategory of: Cybersecurity Supply Chain Risk Management (GV.SC)

High-Level Description

Function: GOVERN (GV) Framework: NIST Cybersecurity Framework v2.0

The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship

What to Check

• Verify GV.SC-07 GV.SC-07 outcome is achieved
• Review documentation and evidence for GV.SC-07
• Assess organizational maturity for GOVERN function
• Map to SP 800-53 controls that satisfy GV.SC-07

How to Test

Step 1: Identify Current Profile

Determine the organization's current and target CSF profile tier for GV.SC-07.

Step 2: Assess Outcome Achievement

# Review organizational policies and procedures
# Check for evidence that GV.SC-07 outcome is met
# Interview stakeholders responsible for GOVERN

Step 3: Map to Technical Controls

Identify which SP 800-53 controls implement this CSF outcome and verify their operating effectiveness.

Tools

Tool	Purpose	Usage
cloud-audit-mcp	Assess cloud security posture	cloud_audit_* tools
Manual Review	Policy and procedure review	Interviews and documentation

Remediation Guide

Achieve the GV.SC-07 GV.SC-07 outcome:

The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship

Risk Assessment

Finding	Severity	Impact
GV.SC-07 GV.SC-07 outcome not achieved	Medium	GOVERN Function Gap

CWE Categories

CWE ID	Title