[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fsr-6":3},{"item":4,"lessons":18,"controls":68,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","sr-6","SR-6","Supplier Assessments and Reviews",25,"US National Institute of Standards and Technology (NIST)","**What it asks for.** The organisation must assess and review the supply chain-related risks associated with suppliers or contractors and the systems, components or services they provide, at a defined frequency.\n\n**In practice.** This means tiering suppliers by criticality, assessing the most important ones in depth through questionnaires, certificates, audit reports or on-site reviews, and reassessing periodically and after incidents or significant changes. Auditors expect the supplier register with tiers, assessment records and follow-up of findings. DORA and NIS2 both emphasise this kind of ongoing supplier oversight. Results should feed procurement and renewal decisions.\n\n**Common gaps.** Assessments are often done once at contract signature and never repeated. Fourth parties, the suppliers of suppliers, are rarely considered. Assessment findings may also be recorded but never followed up with the supplier.","Assess and review the supply chain-related risks associated with suppliers or contractors and the system, system component, or system service they provide [Assignment: organization-defined frequency].\nDiscussion: An assessment and review of supplier risk includes security and supply chain risk management processes, foreign ownership, control or influence (FOCI), and the ability of the supplier to effectively assess subordinate second-tier and third-tier suppliers and contractors. The reviews may be conducted by the organization or by an independent third party. The reviews consider documented processes, documented controls, all-source intelligence, and publicly available information related to the supplier or contractor. Organizations can use open-source information to monitor for indications of stolen information, poor development and quality control practices, information spillage, or counterfeits. In some cases, it may be appropriate or required to share assessment and review results with other organizations in accordance with any applicable rules, policies, or inter-organizational agreements or contracts.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"ransomware-recovery-firm-defrauded-victims-by-secretly-paying-ransoms","Ransomware Recovery Firm Defrauded Victims by Secretly Paying Ransoms","2026-10-08T00:20:18.733+00:00",{"slug":25,"title":26,"published_at":27},"third-party-access-abuse-exposes-88-million-danish-citizens-personal-data","Third-Party Access Abuse Exposes 8.8 Million Danish Citizens' Personal Data","2026-10-06T10:20:35.284+00:00",{"slug":29,"title":30,"published_at":31},"kiteworks-zero-day-forces-emergency-server-shutdowns","Kiteworks Zero-Day Forces Emergency Server Shutdowns","2026-09-28T10:20:20.551+00:00",{"slug":33,"title":34,"published_at":35},"ai-tools-excessive-third-party-access-and-banking-trojans-highlight-this-weeks-threat-landscape","AI Tools, Excessive Third-Party Access, and Banking Trojans Highlight This Week's Threat Landscape","2026-09-24T20:21:18.301+00:00",{"slug":37,"title":38,"published_at":39},"third-party-ics-integrator-access-exposes-critical-infrastructure-to-foreign-cyber-threats","Third-Party ICS Integrator Access Exposes Critical Infrastructure to Foreign Cyber Threats","2026-09-23T22:21:34.789+00:00",{"slug":41,"title":42,"published_at":43},"crowdsec-source-code-stolen-via-third-party-supply-chain-attack","CrowdSec Source Code Stolen via Third-Party Supply Chain Attack","2026-09-21T12:20:54.195+00:00",{"slug":45,"title":46,"published_at":47},"brevo-supply-chain-attack-compromises-100000-sites-via-saml-flaw-and-stolen-api-key","Brevo Supply Chain Attack Compromises 100,000 Sites via SAML Flaw and Stolen API Key","2026-09-18T10:20:22.721+00:00",{"slug":49,"title":50,"published_at":51},"third-party-email-provider-breach-exposes-347000-trezor-users-to-phishing","Third-Party Email Provider Breach Exposes 347,000 Trezor Users to Phishing","2026-09-11T08:20:17.394+00:00",{"slug":53,"title":54,"published_at":55},"social-engineering-via-third-party-contractor-exposes-41m-healthcare-records","Social Engineering via Third-Party Contractor Exposes 4.1M Healthcare Records","2026-09-09T22:20:39.893+00:00",{"slug":57,"title":58,"published_at":59},"pre-installed-backdoors-found-in-globally-distributed-zbt-routers","Pre-Installed Backdoors Found in Globally Distributed ZBT Routers","2026-08-27T20:20:21.632+00:00",{"slug":61,"title":62,"published_at":63},"ai-agent-privilege-escalation-exposes-secrets-and-enables-supply-chain-attacks","AI Agent Privilege Escalation Exposes Secrets and Enables Supply Chain Attacks","2026-08-04T12:22:00.962+00:00",{"slug":65,"title":66,"published_at":67},"n-central-auth-bypass-flaw-actively-exploited-msps-at-risk-of-cascading-compromise","N-central Auth Bypass Flaw Actively Exploited — MSPs at Risk of Cascading Compromise","2026-08-03T18:20:43.457+00:00",[69,74,79,84,89,93],{"slug":70,"name":71,"problem":72,"stories":73},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",10,{"slug":75,"name":76,"problem":77,"stories":78},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",8,{"slug":80,"name":81,"problem":82,"stories":83},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",6,{"slug":85,"name":86,"problem":87,"stories":88},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",4,{"slug":90,"name":91,"problem":92,"stories":88},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":94,"name":95,"problem":96,"stories":97},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",3,[99,104,110,114,117,121,127,131],{"family":5,"item":100,"code":101,"title":102,"together":103},"ac-2","AC-2","Account Management",19,{"family":105,"item":106,"code":107,"title":108,"together":109},"cis","6","Control 6","Access Control Management",13,{"family":111,"item":112,"code":113,"title":113,"together":109},"itil","overview","ITIL",{"family":105,"item":115,"code":116,"title":102,"together":109},"5","Control 5",{"family":5,"item":118,"code":119,"title":120,"together":109},"ac-6","AC-6","Least Privilege",{"family":122,"item":123,"code":124,"title":125,"together":126},"gdpr","28","Article 28","Processor",12,{"family":105,"item":128,"code":129,"title":130,"together":126},"15","Control 15","Service Provider Management",{"family":122,"item":132,"code":133,"title":134,"together":135},"32","Article 32","Security of processing",11]