This requirement exists to assess, monitor, plan for, report on, review, and improve resilience of critical third parties and supply-chain dependencies, with specific focus on supplier criticality assessment, so that critical services remain resilient against disruption and decisions are accountable and traceable.
Establish and document the process for supplier criticality assessment. Define accountable owners, required inputs and outputs, assessment or approval criteria, review frequency, monitoring, reporting, exception handling, evidence requirements, and escalation paths. Apply the process consistently to critical services and their dependencies, and integrate it with risk management, business continuity, incident management, technology operations, and third-party management where relevant.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §2.14-3.1 – Vendor IS classification; §2.14-3.4 – Periodic assessment |
India
Guideline
|
vLatest | View → |
| RBI-CSF | RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: 11) Vendor Risk Management – 11.1 Accountability for security risks in outsourced and partner arrangements; 11) Vendor Risk Management – 11.3 Due diligence, oversight and management of third-party vendors/service providers/partners; 19) Incident Response & Management – 19.5 Resilience capabilities and coordinated testing across interconnected systems, vendors and partners |
India
Regulation
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 1.6 GV.SC: Cybersecurity Supply Chain Risk Management; 1.1 GV.OC: Organizational Context |
India
Regulation
|
vLatest | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 28(1) – General principles for ICT third-party risk management Article 29 – Preliminary assessment of ICT concentration risk at entity level |
EU
Regulation
|
vCurrent | View → |
| HIPAA | Health Insurance Portability and Accountability Act HIPAA is a U.S. federal law supported by implement... Clause: § 164.308(a)(13)(ii)(A) Criticality analysis; § 164.308(a)(2) Standard: Risk analysis; § 164.308(b)(1)-(3) Business associate contracts and other arrangements |
US
Law
|
vCurrent | View → |
| NIS2 | NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 21(2)(d) – Supply chain security, including relationships with direct suppliers/service providers Article 21(3) – Supplier vulnerabilities, product/cybersecurity quality and secure development; critical supply-chain risk assessment results |
EU
Directive
|
vCurrent | View → |
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.4 – Deliver, Service and Support (DSS) > DSS04 – Managed Continuity > DSS04.02 – Maintain business resilience. 4.4 – Deliver, Service and Support (DSS) > DSS01 – Managed Operations > DSS01.02 – Manage outsourced I&T services. |
COBIT
Governance Framework
|
v2019 | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: PR.IR – Technology Infrastructure Resilience | PR.IR-03 – Mechanisms are implemented to achieve resilience requirements in normal and adverse situations PR.IR – Technology Infrastructure Resilience | PR.IR-04 – Adequate resource capacity to ensure availability is maintained GV.OC – Organizational Context | GV.OC-04 – Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.16 – RISK ASSESSMENT; RA-9 – CRITICALITY ANALYSIS |
NIST
Control Catalog
|
vRev. 5 | View → |
| GDPR | General Data Protection Regulation (GDPR) The General Data Protection Regulation is a bindin... Clause: Article 28(1) – Processor requirements; Article 32(2) – Risk-based security measures |
EU
Regulation
|
vCurrent | View → |
| NPCI-ISR | NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Operational Review; Infrastructure Resiliency |
India
Standard
|
vLatest | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC9.2 – Risk Mitigation – The entity assesses and manages risks associated with vendors and business partners. CC9.1 – Risk Mitigation – The entity identifies, selects, and develops risk mitigation activities for risks arising from potential business disruptions. |
AICPA
Audit Framework
|
vLatest | View → |