[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-csf\u002Fgv-sc":3},{"item":4,"lessons":16,"controls":66,"related":95},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-csf","gv-sc","GV.SC","Cybersecurity Supply Chain Risk Management",19,"US National Institute of Standards and Technology (NIST)","**What it asks for.** This Govern category asks the organisation to identify, assess and manage cyber risks arising from its suppliers and other third parties through an agreed programme. It brings together strategy, roles, supplier prioritisation, contract requirements and monitoring across the supplier life cycle.\n\n**In practice.** The organisation sets up a supply chain risk programme with clear owners, inventories and tiers its suppliers by criticality, and builds security requirements into contracts. Suppliers are assessed before engagement and monitored afterwards, incident response plans include relevant suppliers, and offboarding is managed. Evidence includes the supplier register, tiering criteria, assessments, contract clauses and records of joint exercises or reviews.\n\n**Common gaps.** Programmes often stop at questionnaires and do not cover fourth parties or software components. Monitoring after onboarding is weak, and suppliers are rarely included in incident planning.",null,"https:\u002F\u002Fwww.nist.gov\u002Fcyberframework","Open the Cybersecurity Framework at NIST","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},27,[19,23,27,31,35,39,43,46,50,54,58,62],{"slug":20,"title":21,"published_at":22},"third-party-vendor-breach-exposes-uber-drivers-personal-data","Third-Party Vendor Breach Exposes Uber Drivers' Personal Data","2026-11-14T02:20:23.656+00:00",{"slug":24,"title":25,"published_at":26},"third-party-email-service-breach-exposes-77-million-addresses-across-400-organizations","Third-Party Email Service Breach Exposes 77 Million Addresses Across 400 Organizations","2026-11-13T20:20:22.449+00:00",{"slug":28,"title":29,"published_at":30},"client-side-supply-chain-attacks-can-bypass-all-security-controls-at-runtime","Client-Side Supply Chain Attacks Can Bypass All Security Controls at Runtime","2026-11-12T15:21:39.056+00:00",{"slug":32,"title":33,"published_at":34},"third-party-provider-breach-exposes-sensitive-client-data-at-baker-tilly","Third-Party Provider Breach Exposes Sensitive Client Data at Baker Tilly","2026-11-12T00:20:24.197+00:00",{"slug":36,"title":37,"published_at":38},"third-party-ai-provider-breach-exposes-notion-customer-chat-transcripts-1794432025691","Third-Party AI Provider Breach Exposes Notion Customer Chat Transcripts","2026-11-11T21:20:25.576+00:00",{"slug":40,"title":41,"published_at":42},"dual-breaches-at-fireworks-ai-expose-supply-chain-and-access-control-gaps","Dual Breaches at Fireworks AI Expose Supply Chain and Access Control Gaps","2026-11-10T17:22:22.909+00:00",{"slug":44,"title":37,"published_at":45},"third-party-ai-provider-breach-exposes-notion-customer-chat-transcripts","2026-11-10T17:20:22.297+00:00",{"slug":47,"title":48,"published_at":49},"hardware-wallet-implant-highlights-reseller-supply-chain-risk","Hardware Wallet Implant Highlights Reseller Supply Chain Risk","2026-10-30T16:20:28.963+00:00",{"slug":51,"title":52,"published_at":53},"four-emerging-cyber-threats-demand-proactive-resilience-planning","Four Emerging Cyber Threats Demand Proactive Resilience Planning","2026-09-29T12:20:52.94+00:00",{"slug":55,"title":56,"published_at":57},"third-party-ics-integrator-access-enables-foreign-actor-breach-of-industrial-data","Third-Party ICS Integrator Access Enables Foreign Actor Breach of Industrial Data","2026-09-24T12:20:23.969+00:00",{"slug":59,"title":60,"published_at":61},"ransomware-surge-exposes-manufacturing-supply-chain-weaknesses","Ransomware Surge Exposes Manufacturing Supply Chain Weaknesses","2026-09-17T14:22:18.091+00:00",{"slug":63,"title":64,"published_at":65},"nvidias-hugging-face-acquisition-raises-open-source-ai-security-concerns","Nvidia's Hugging Face Acquisition Raises Open-Source AI Security Concerns","2026-09-04T14:21:53.756+00:00",[67,72,76,81,85,90],{"slug":68,"name":69,"problem":70,"stories":71},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",12,{"slug":73,"name":74,"problem":75,"stories":71},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",{"slug":77,"name":78,"problem":79,"stories":80},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",7,{"slug":82,"name":83,"problem":84,"stories":80},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",{"slug":86,"name":87,"problem":88,"stories":89},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",6,{"slug":91,"name":92,"problem":93,"stories":94},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",4,[96,102,108,112,118,122,127,132],{"family":97,"item":98,"code":99,"title":100,"together":101},"nist-sp","800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",16,{"family":103,"item":104,"code":105,"title":106,"together":107},"cis","2","Control 2","Inventory and Control of Software Assets",15,{"family":103,"item":109,"code":110,"title":111,"together":71},"15","Control 15","Service Provider Management",{"family":113,"item":114,"code":115,"title":116,"together":117},"gdpr","32","Article 32","Security of processing",10,{"family":97,"item":119,"code":120,"title":121,"together":117},"800-218","SP 800-218","SP 800-218: Secure Software Development Framework (SSDF) Version 1.1",{"family":103,"item":123,"code":124,"title":125,"together":126},"16","Control 16","Application Software Security",9,{"family":128,"item":129,"code":130,"title":131,"together":80},"nis2","21-2-d","Article 21(2)(d)","Supply chain security (Article 21(2)(d))",{"family":133,"item":134,"code":135,"title":136,"together":89},"nist-800-53","sa-9","SA-9","External System Services"]