VenDefend Third-Party Risk Management
Book A Demo

NIST CSF v2.0 · Govern

Third-party cyber risk checklist

Review how your organisation manages cyber risk from suppliers. Choose one critical supplier and use its records to test how your approach works in practice.

10 checks

All 10 GV.SC subcategories, each with a practical example of evidence.

One critical supplier

Use a real supplier's records to test how your approach works in practice.

No sign-up

Your answers stay in your browser. See your gaps instantly.

This checklist is an indicative self-assessment based on the Cybersecurity Supply Chain Risk Management (GV.SC) category of the NIST Cybersecurity Framework v2.0. It does not constitute a formal audit or certification.

NIST CSF v2.0 Govern: GV.SC-01 to 04 and 06

Governance and supplier selection

  1. GV.SC-01

    Have the teams involved agreed on the goals, policy and steps they will use to manage supplier cyber risk?

    Example: A supplier risk policy agreed by procurement, security and business owners.

  2. GV.SC-02

    Do our teams, suppliers, customers and partners know who handles each cyber risk and how to coordinate when responsibilities overlap?

    Example: A shared contact and responsibility list showing who escalates a suspected breach.

  3. GV.SC-03

    Do supplier findings feed into cyber and business risk assessments, decisions and improvements?

    Example: A supplier access issue raised at a risk review led to a change in onboarding.

  4. GV.SC-04

    Do we know which suppliers we use and which would have the greatest impact if compromised or unavailable?

    Example: A supplier register links payroll processing to its provider and explains its priority.

  5. GV.SC-06

    Before signing, do we assess the proposed service and decide how to reduce the risks we find?

    Example: A pre-contract review identifies who can access customer data and resolves an access gap.

NIST CSF v2.0 Govern: GV.SC-05 and 07 to 10

Contract terms and ongoing review

  1. GV.SC-05

    Have we agreed which security requirements matter most for this service and included them in the supplier agreement?

    Example: The contract specifies how quickly the provider must report a suspected data breach.

  2. GV.SC-07

    Do we record and rank risks from suppliers, their products, services and other third parties, then act on them and monitor changes?

    Example: A risk record links an overdue software fix to the affected service, owner and follow-up.

  3. GV.SC-08

    Do relevant providers and partners take part in incident planning, response and recovery?

    Example: A joint exercise tests who alerts customers and who confirms it is safe to restart.

  4. GV.SC-09

    Do security and business risk teams track how well supplier safeguards work from technology selection through retirement?

    Example: A review tracks unresolved security findings for a hosted service from purchase to exit.

  5. GV.SC-10

    Does our exit plan cover cyber risks and responsibilities that continue after the supplier agreement ends?

    Example: An exit record confirms access removal, data return or deletion, and who handles later incidents.