What it asks for. This Govern category asks the organisation to identify, assess and manage cyber risks arising from its suppliers and other third parties through an agreed programme. It brings together strategy, roles, supplier prioritisation, contract requirements and monitoring across the supplier life cycle.
In practice. The organisation sets up a supply chain risk programme with clear owners, inventories and tiers its suppliers by criticality, and builds security requirements into contracts. Suppliers are assessed before engagement and monitored afterwards, incident response plans include relevant suppliers, and offboarding is managed. Evidence includes the supplier register, tiering criteria, assessments, contract clauses and records of joint exercises or reviews.
Common gaps. Programmes often stop at questionnaires and do not cover fourth parties or software components. Monitoring after onboarding is weak, and suppliers are rarely included in incident planning.