gv-sc-05-gvsc-05

name	GV.SC-05_gvsc-05
description	Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements
category	configuration
version	2.0
author	cyberstrike-official
tags	["nist","csf","v2.0","gv-sc-05","gv","subcategory"]
tech_stack	["any"]
cwe_ids	[]
chains_with	[]
prerequisites	["Cybersecurity Supply Chain Risk Management (GV.SC)"]
severity_boost	{}

GV.SC-05 GV.SC-05

Subcategory of: Cybersecurity Supply Chain Risk Management (GV.SC)

High-Level Description

Function: GOVERN (GV) Framework: NIST Cybersecurity Framework v2.0

Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties

What to Check

• Verify GV.SC-05 GV.SC-05 outcome is achieved
• Review documentation and evidence for GV.SC-05
• Assess organizational maturity for GOVERN function
• Map to SP 800-53 controls that satisfy GV.SC-05

How to Test

Step 1: Identify Current Profile

Determine the organization's current and target CSF profile tier for GV.SC-05.

Step 2: Assess Outcome Achievement

# Review organizational policies and procedures
# Check for evidence that GV.SC-05 outcome is met
# Interview stakeholders responsible for GOVERN

Step 3: Map to Technical Controls

Identify which SP 800-53 controls implement this CSF outcome and verify their operating effectiveness.

Tools

Tool	Purpose	Usage
cloud-audit-mcp	Assess cloud security posture	cloud_audit_* tools
Manual Review	Policy and procedure review	Interviews and documentation

Remediation Guide

Achieve the GV.SC-05 GV.SC-05 outcome:

Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties

Risk Assessment

Finding	Severity	Impact
GV.SC-05 GV.SC-05 outcome not achieved	Medium	GOVERN Function Gap

CWE Categories

CWE ID	Title