[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-csf\u002Fgv-sc":3},{"item":4,"lessons":16,"controls":66,"related":95},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-csf","gv-sc","GV.SC","Cybersecurity Supply Chain Risk Management",19,"US National Institute of Standards and Technology (NIST)","**What it asks for.** This Govern category asks the organisation to identify, assess and manage cyber risks arising from its suppliers and other third parties through an agreed programme. It brings together strategy, roles, supplier prioritisation, contract requirements and monitoring across the supplier life cycle.\n\n**In practice.** The organisation sets up a supply chain risk programme with clear owners, inventories and tiers its suppliers by criticality, and builds security requirements into contracts. Suppliers are assessed before engagement and monitored afterwards, incident response plans include relevant suppliers, and offboarding is managed. Evidence includes the supplier register, tiering criteria, assessments, contract clauses and records of joint exercises or reviews.\n\n**Common gaps.** Programmes often stop at questionnaires and do not cover fourth parties or software components. Monitoring after onboarding is weak, and suppliers are rarely included in incident planning.",null,"https:\u002F\u002Fwww.nist.gov\u002Fcyberframework","Open the Cybersecurity Framework at NIST","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"four-emerging-cyber-threats-demand-proactive-resilience-planning","Four Emerging Cyber Threats Demand Proactive Resilience Planning","2026-09-29T12:20:52.94+00:00",{"slug":23,"title":24,"published_at":25},"third-party-ics-integrator-access-enables-foreign-actor-breach-of-industrial-data","Third-Party ICS Integrator Access Enables Foreign Actor Breach of Industrial Data","2026-09-24T12:20:23.969+00:00",{"slug":27,"title":28,"published_at":29},"ransomware-surge-exposes-manufacturing-supply-chain-weaknesses","Ransomware Surge Exposes Manufacturing Supply Chain Weaknesses","2026-09-17T14:22:18.091+00:00",{"slug":31,"title":32,"published_at":33},"nvidias-hugging-face-acquisition-raises-open-source-ai-security-concerns","Nvidia's Hugging Face Acquisition Raises Open-Source AI Security Concerns","2026-09-04T14:21:53.756+00:00",{"slug":35,"title":36,"published_at":37},"executive-order-targets-foreign-hardware-backdoors-in-us-power-grid","Executive Order Targets Foreign Hardware Backdoors in US Power Grid","2026-08-27T16:20:38.561+00:00",{"slug":39,"title":40,"published_at":41},"quantum-guard-act-pushes-energy-sector-toward-post-quantum-cryptography-standards","Quantum-GUARD Act Pushes Energy Sector Toward Post-Quantum Cryptography Standards","2026-08-24T20:21:06.989+00:00",{"slug":43,"title":44,"published_at":45},"openai-launches-ai-powered-cyber-services-via-daybreak-program","OpenAI Launches AI-Powered Cyber Services via Daybreak Program","2026-08-10T22:21:10.402+00:00",{"slug":47,"title":48,"published_at":49},"ai-agent-attempts-social-engineering-attack-on-open-source-maintainer","AI Agent Attempts Social Engineering Attack on Open Source Maintainer","2026-08-05T20:22:13.739+00:00",{"slug":51,"title":52,"published_at":53},"north-korean-hackers-compromise-major-npm-packages-via-maintainer-social-engineering","North Korean Hackers Compromise Major NPM Packages via Maintainer Social Engineering","2026-07-30T20:21:01.57+00:00",{"slug":55,"title":56,"published_at":57},"cisa-releases-guidance-on-open-source-software-security-for-federal-agencies","CISA Releases Guidance on Open-Source Software Security for Federal Agencies","2026-07-30T20:20:25.984+00:00",{"slug":59,"title":60,"published_at":61},"updated-sbom-guidance-strengthens-software-supply-chain-transparency","Updated SBOM Guidance Strengthens Software Supply Chain Transparency","2026-07-30T10:21:08.131+00:00",{"slug":63,"title":64,"published_at":65},"updated-sbom-guidance-raises-the-bar-for-software-supply-chain-transparency","Updated SBOM Guidance Raises the Bar for Software Supply Chain Transparency","2026-07-29T16:22:50.804+00:00",[67,72,77,81,86,90],{"slug":68,"name":69,"problem":70,"stories":71},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",11,{"slug":73,"name":74,"problem":75,"stories":76},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",5,{"slug":78,"name":79,"problem":80,"stories":76},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":82,"name":83,"problem":84,"stories":85},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",4,{"slug":87,"name":88,"problem":89,"stories":85},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",{"slug":91,"name":92,"problem":93,"stories":94},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",2,[96,102,108,113,118,123,128,133],{"family":97,"item":98,"code":99,"title":100,"together":101},"nist-sp","800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",16,{"family":103,"item":104,"code":105,"title":106,"together":107},"cis","2","Control 2","Inventory and Control of Software Assets",14,{"family":97,"item":109,"code":110,"title":111,"together":112},"800-218","SP 800-218","SP 800-218: Secure Software Development Framework (SSDF) Version 1.1",10,{"family":114,"item":115,"code":116,"title":117,"together":112},"gdpr","32","Article 32","Security of processing",{"family":103,"item":119,"code":120,"title":121,"together":122},"16","Control 16","Application Software Security",9,{"family":103,"item":124,"code":125,"title":126,"together":127},"15","Control 15","Service Provider Management",7,{"family":129,"item":130,"code":131,"title":132,"together":76},"iso","27036","ISO\u002FIEC 27036","ISO\u002FIEC 27036: Cybersecurity, Supplier relationships",{"family":134,"item":135,"code":136,"title":137,"together":76},"slsa","overview","SLSA","SLSA (Supply-chain Levels for Software Artifacts)"]