---

id: "GV.SC-04" title: "Supply Chain Risk Management" function: "GV" function_name: "Govern" category: "GV.SC" category_name: "Supply Chain Risk Management" description: "Suppliers and third-party partners are evaluated and monitored." controls: - SA-1 - SA-3 - SA-4 - SA-5 - SR-1 - SR-2 - SR-3 - SR-4 - SR-5 - SR-6

---

GV.SC-04: Supply Chain Risk Management

Description

Suppliers and third-party partners are evaluated and monitored.

Category Context

Function: GV — Govern Category: GV.SC — Supply Chain Risk Management

Cybersecurity supply chain risk management processes are established and implemented.

Mapped SP 800-53 Controls

• SA-1 (System and Services Acquisition) — View Control
• SA-3 (System and Services Acquisition) — View Control
• SA-4 (System and Services Acquisition) — View Control
• SA-5 (System and Services Acquisition) — View Control
• SR-1 (Supply Chain Risk Management) — View Control
• SR-2 (Supply Chain Risk Management) — View Control
• SR-3 (Supply Chain Risk Management) — View Control
• SR-4 (Supply Chain Risk Management) — View Control
• SR-5 (Supply Chain Risk Management) — View Control
• SR-6 (Supply Chain Risk Management) — View Control