GV.SC 05 Gvsc 05

---
name: "GV.SC-05_gvsc-05"
description: "Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements"
category: "configuration"
version: "2.0"
author: "cyberstrike-official"
tags:
  - nist
  - csf
  - v2.0
  - gv-sc-05
  - gv
  - subcategory
tech_stack:
  - any
cwe_ids: []
chains_with: []
prerequisites:
  - Cybersecurity Supply Chain Risk Management (GV.SC)
severity_boost: {}
---

# GV.SC-05 GV.SC-05

> **Subcategory of:** Cybersecurity Supply Chain Risk Management (GV.SC)

## High-Level Description

**Function:** GOVERN (GV)
**Framework:** NIST Cybersecurity Framework v2.0

Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties

## What to Check

- [ ] Verify GV.SC-05 GV.SC-05 outcome is achieved
- [ ] Review documentation and evidence for GV.SC-05
- [ ] Assess organizational maturity for GOVERN function
- [ ] Map to SP 800-53 controls that satisfy GV.SC-05

## How to Test

### Step 1: Identify Current Profile

Determine the organization's current and target CSF profile tier for GV.SC-05.

### Step 2: Assess Outcome Achievement

```
# Review organizational policies and procedures
# Check for evidence that GV.SC-05 outcome is met
# Interview stakeholders responsible for GOVERN
```

### Step 3: Map to Technical Controls

Identify which SP 800-53 controls implement this CSF outcome and verify their operating effectiveness.

## Tools

| Tool            | Purpose                       | Usage                        |
| --------------- | ----------------------------- | ---------------------------- |
| cloud-audit-mcp | Assess cloud security posture | `cloud_audit_*` tools        |
| Manual Review   | Policy and procedure review   | Interviews and documentation |

## Remediation Guide

Achieve the GV.SC-05 GV.SC-05 outcome:

Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties

## Risk Assessment

| Finding                                | Severity | Impact              |
| -------------------------------------- | -------- | ------------------- |
| GV.SC-05 GV.SC-05 outcome not achieved | Medium   | GOVERN Function Gap |

## CWE Categories

| CWE ID | Title                 |
| ------ | --------------------- |
| N/A    | No direct CWE mapping |

## References

- [NIST CSF v2.0](https://www.nist.gov/cyberframework)
- [NIST CSF v2.0 Reference Tool](https://csrc.nist.gov/projects/cybersecurity-framework/filters#/csf/filters)
- [CSF 2.0 Quick Start Guides](https://www.nist.gov/cyberframework/getting-started)

## Checklist

- [ ] Current profile tier assessed
- [ ] Target profile tier defined
- [ ] Gap analysis completed
- [ ] SP 800-53 control mapping verified
- [ ] Implementation roadmap exists