What it asks for. In CSF 1.1 this Identify category asked organisations to set priorities and processes for identifying, assessing and managing supply chain risk, including routine assessment of suppliers and third party partners through audits and test results. CSF 2.0 moved this material into the Govern function as GV.SC.
In practice. The organisation identifies and prioritises suppliers, includes security requirements in contracts, and checks over time that suppliers meet them through assessments, certifications, audit reports or test results. Response and recovery planning includes key suppliers. Evidence includes the supplier inventory, risk ratings, assessment results and contract terms.
Common gaps. Supplier assessments are often only performed at onboarding and rely entirely on self attestation. Critical suppliers are rarely involved in exercises, and contractual rights to audit are seldom used.