[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-csf\u002Fid-sc":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-csf","id-sc","ID.SC-4","Supply Chain Risk Management (CSF 1.1)",219,"US National Institute of Standards and Technology (NIST)","**What it asks for.** In CSF 1.1 this Identify category asked organisations to set priorities and processes for identifying, assessing and managing supply chain risk, including routine assessment of suppliers and third party partners through audits and test results. CSF 2.0 moved this material into the Govern function as GV.SC.\n\n**In practice.** The organisation identifies and prioritises suppliers, includes security requirements in contracts, and checks over time that suppliers meet them through assessments, certifications, audit reports or test results. Response and recovery planning includes key suppliers. Evidence includes the supplier inventory, risk ratings, assessment results and contract terms.\n\n**Common gaps.** Supplier assessments are often only performed at onboarding and rely entirely on self attestation. Critical suppliers are rarely involved in exercises, and contractual rights to audit are seldom used.",null,"https:\u002F\u002Fwww.nist.gov\u002Fcyberframework","Open the Cybersecurity Framework at NIST","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},214,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"connectwise-supply-chain-attack-compromises-162-microsoft-365-tenants","ConnectWise Supply-Chain Attack Compromises 162 Microsoft 365 Tenants","2026-10-17T16:20:21.545+00:00",{"slug":24,"title":25,"published_at":26},"compromised-connectwise-credential-exposes-173-microsoft-365-tenants","Compromised ConnectWise Credential Exposes 173 Microsoft 365 Tenants","2026-10-17T08:20:20.122+00:00",{"slug":28,"title":29,"published_at":30},"aomei-backupper-update-servers-hijacked-to-distribute-backdoor","AOMEI Backupper Update Servers Hijacked to Distribute Backdoor","2026-10-16T18:21:08.893+00:00",{"slug":32,"title":33,"published_at":34},"ransomware-negotiator-secretly-worked-for-the-attackers","Ransomware Negotiator Secretly Worked for the Attackers","2026-10-16T15:20:17.253+00:00",{"slug":36,"title":37,"published_at":38},"malicious-aur-packages-execute-root-level-malware-via-typosquatting","Malicious AUR Packages Execute Root-Level Malware via Typosquatting","2026-10-15T18:20:20.988+00:00",{"slug":40,"title":41,"published_at":42},"zero-click-spyware-delivered-via-ad-networks-targets-journalists","Zero-Click Spyware Delivered via Ad Networks Targets Journalists","2026-10-15T12:21:25.749+00:00",{"slug":44,"title":45,"published_at":46},"north-korean-it-workers-infiltrate-us-companies-via-laptop-farms-and-stolen-identities","North Korean IT Workers Infiltrate US Companies via Laptop Farms and Stolen Identities","2026-10-14T20:20:23.163+00:00",{"slug":48,"title":49,"published_at":50},"north-korean-it-worker-fraud-exposes-hiring-and-identity-verification-gaps","North Korean IT Worker Fraud Exposes Hiring and Identity Verification Gaps","2026-10-14T18:21:30.184+00:00",{"slug":52,"title":53,"published_at":54},"north-korean-it-worker-laptop-farms-expose-hiring-identity-verification-gaps","North Korean IT Worker Laptop Farms Expose Hiring & Identity Verification Gaps","2026-10-14T12:21:20.742+00:00",{"slug":56,"title":57,"published_at":58},"hardware-implant-in-reseller-crypto-wallets-drains-86m","Hardware Implant in Reseller Crypto Wallets Drains $86M","2026-10-13T12:21:47.245+00:00",{"slug":60,"title":61,"published_at":62},"hardware-implants-in-resold-crypto-wallets-expose-supply-chain-risk","Hardware Implants in Resold Crypto Wallets Expose Supply Chain Risk","2026-10-12T14:22:09.278+00:00",{"slug":64,"title":65,"published_at":66},"shinyhunters-exploits-third-party-vendor-zero-day-to-breach-fbi-systems","ShinyHunters Exploits Third-Party Vendor Zero-Day to Breach FBI Systems","2026-10-09T18:20:41.265+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",98,{"slug":74,"name":75,"problem":76,"stories":77},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",83,{"slug":79,"name":80,"problem":81,"stories":82},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",47,{"slug":84,"name":85,"problem":86,"stories":87},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",42,{"slug":89,"name":90,"problem":91,"stories":92},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",40,{"slug":94,"name":95,"problem":96,"stories":97},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",37,[99,105,111,117,122,128,132,138],{"family":100,"item":101,"code":102,"title":103,"together":104},"nist-sp","800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",158,{"family":106,"item":107,"code":108,"title":109,"together":110},"cis","2","Control 2","Inventory and Control of Software Assets",140,{"family":112,"item":113,"code":114,"title":115,"together":116},"gdpr","32","Article 32","Security of processing",119,{"family":106,"item":118,"code":119,"title":120,"together":121},"16","Control 16","Application Software Security",96,{"family":123,"item":124,"code":125,"title":126,"together":127},"slsa","overview","SLSA","SLSA (Supply-chain Levels for Software Artifacts)",82,{"family":129,"item":124,"code":130,"title":130,"together":131},"itil","ITIL",72,{"family":133,"item":134,"code":135,"title":136,"together":137},"nist-800-53","sa-12","SA-12","Supply Chain Protection",67,{"family":100,"item":139,"code":140,"title":141,"together":142},"800-218","SP 800-218","SP 800-218: Secure Software Development Framework (SSDF) Version 1.1",65]