PR.AC-1: Identity Management, Authentication and Access Control
Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes.
ID.SC-5: Supply Chain Risk Management
Response and recovery planning and testing are conducted with suppliers and third-party providers.
ID.SC-4: Supply Chain Risk Management
Suppliers and third-party partners are routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their contractual obligations.
ID.SC-3: Supply Chain Risk Management
Suppliers and third-party partners are identified, prioritized, and assessed using a cybersecurity risk assessment process.
ID.SC-2: Supply Chain Risk Management
Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders.
ID.SC-1: Supply Chain Risk Management
Cybersecurity risks to organizational assets are identified and managed.
ID.RM-3: Risk Management Strategy
The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector-specific risk analysis.
ID.RM-2: Risk Management Strategy
Organizational risk tolerance is determined and clearly expressed.
ID.RM-1: Risk Management Strategy
Risk management processes are established, managed, and agreed to by organizational stakeholders.
—ID.GV-4: Governance
Governance and risk management processes address cybersecurity risks.