This requirement exists to identify, assess, mitigate, monitor, report, review, and improve concentration risks arising from third-party, geographic, technology, and critical dependency concentrations, specifically addressing mitigation planning, so that third-party risks remain identified, controlled, and aligned with organizational risk appetite.
Establish and document the process for mitigation planning. Define accountable owners, required inputs and outputs, assessment or approval criteria, review frequency, monitoring, reporting, exception handling, evidence requirements, and escalation paths. Apply the process consistently across relevant third parties based on criticality, data sensitivity, service dependency, and risk.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| ISO27001 | ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for... Clause: 6.1.3 – Information security risk treatment |
ISO
Standard
|
v2022 | View → |
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §1.8-V – Risk Treatment |
India
Guideline
|
vLatest | View → |
| RBI-CSF | RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: 11) Vendor Risk Management – 11.2 Risk assessment for outsourcing critical processes and vendor/partner selection; 11) Vendor Risk Management – 11.4 Framework to assess, approve, review, control and monitor vendor/outsourcing risks and materiality |
India
Regulation
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 1.6 GV.SC: Cybersecurity Supply Chain Risk Management |
India
Regulation
|
vLatest | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 29 – Preliminary assessment of ICT concentration risk at entity level Article 28(2) – ICT third-party risk strategy and review |
EU
Regulation
|
vCurrent | View → |
| NIS2 | NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 21(3) – Supplier vulnerabilities, product/cybersecurity quality and secure development; critical supply-chain risk assessment results |
EU
Directive
|
vCurrent | View → |
| PCI-DSS | PCI DSS PCI DSS is an industry security standard maintaine... Clause: 12.8.1 – A list of all third-party service providers; 12.8.2 – Written agreements with TPSPs are |
PCI
Standard
|
v4 | View → |
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.2 – Align, Plan and Organize (APO) > APO12 – Managed Risk > APO12.02 – Analyze risk. |
COBIT
Governance Framework
|
v2019 | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: GV.SC – Cybersecurity Supply Chain Risk Management | GV.SC-01 – A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders GV.SC – Cybersecurity Supply Chain Risk Management | GV.SC-07 – The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.20 – SUPPLY CHAIN RISK MANAGEMENT; SR-2 – SUPPLY CHAIN RISK MANAGEMENT PLAN |
NIST
Control Catalog
|
vRev. 5 | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC9.2 – Risk Mitigation – The entity assesses and manages risks associated with vendors and business partners. CC9.1 – Risk Mitigation – The entity identifies, selects, and develops risk mitigation activities for risks arising from potential business disruptions. |
AICPA
Audit Framework
|
vLatest | View → |