Vendor Risk Management and NIST

Vendor Risk Management and NIST

What is NIST CSF?

NIST CSF is voluntary guidance based on existing standards, guidelines, and practices to help organizations better manage and reduce information security risk. Another benefit is an increased level of communication around information security with both internal and external organizational stakeholders. The National Institute of Standards and Technology (NIST) developed the Cybersecurity Framework (CSF) because of Presidential Executive Order 13636, which was signed in 2013. 

NIST CSF 1.0 vs. NIST 1.1

The first version of the NIST CSF has served us well since its adoption in 2014.  5 years have passed, and the threat landscape has not been stagnant.  Because of this a new version, v1.1, was adopted in 2018.  Much of the framework still resembles the original v1.0 framework with changes to language that more clearly states the control(s) intent. 

There are some additional categories added to v1.1 that are a result of the current emerging threats facing many organizations.  Supply Chain Risk Management ID.SC (Vendor Risk Management) is an area that certainly deserves to be formally addressed by the new framework.

There are 5 sub-categories that fall under ID.SC.  Let’s dig a little into each category and look at what this means from a practical standpoint.

Supply Chain Risk Management (ID.SC)

“The organization’s priorities, constraints, risk tolerances, and assumptions are established and used to support risk decisions associated with managing supply chain risk. The organization has established and implemented the processes to identify, assess and manage supply chain risks.”

Translation – Your organization formally addresses the risks associated with using 3rd party vendors to support your business initiatives.  The process is formal and has structure to ensure you evaluate all vendors, not just the ones you feel are important.

ID.SC Subsection NIST Language Explained
ID.SC-1 Cyber supply chain risk management processes are
identified, established, assessed, managed, and agreed toby organizational stakeholders
Executive management requires that Vendor Risk
Management processes be established. They support thiswith resources (money and staff) needed to properly
manage. They communicate this requirement through
governance (policies).
ID.SC-2 Suppliers and third-party partners of information
systems, components, and services are identified,
prioritized, and assessed using a cyber supply chain risk
assessment process
Every vendor has been identified and classified (based
on potential risk to you) regardless of the goods\services
supplied.  They should be evaluated with the same
criteria initially with more scrutiny applied based on risk levels introduced.
ID.SC-3 Contracts with suppliers and third-party partners are
used to implement appropriate measures designed to
meet the objectives of an organization’s cybersecurity
program and Cyber Supply Chain Risk Management Plan.
You can use contracts to ensure 3rd party suppliers meet your information security requirements which might be more stringent than their own internal requirements.
ID.SC-4 Suppliers and third-party partners are routinely assessed using audits, test results, or other forms of evaluations
to confirm they are meeting their contractual obligations.
In ID.SC-2 above, you initially evaluate 3rd party vendors and assign a risk level.  That process should be repeated on a regular (annual) basis. You can focus on the higher risk vendors but you need to consider ALL vendors, even the low-risk ones.
ID.SC-5 Response and recovery planning and testing are
conducted with suppliers and third-party providers
High-risk vendors, ones that could cause grave harm to
your organization, should be tested for response and
recovery assurances. You don’t want their lack of
planning and preparedness to negatively affect your

OK, Now what?

Once you determine that you will follow these sound information security principals, you will need a way to do so.  Traditionally, questionnaire forms and spreadsheets were used to track vendor risk. Because of the explosion of 3rd party vendor use, this process is no longer a viable solution.

SecurityStudio allows you to address the new NIST cybersecurity framework – Supply Chain Risk Management (ID.SC) guidelines.  The once cumbersome process is greatly simplified, efficient and thorough, which puts you in a defensible position.

If you need help, contact us! If you would like a SecurityStudio demo, schedule a demo today!


Estimate your score or book free demo today