NIST Cybersecurity Framework 2.0: Quick-Start Guide for Cybersecurity Supply Chain Risk Management (C-SCRM)

Key concepts

The guide focuses on two uses of CSF 2.0: standing up a supply chain risk management capability through the GV.SC outcomes, and using CSF outcomes to state security requirements to suppliers. It includes a checklist of GV.SC activities.

How it is organized

• Supply chain risk management overview
• Using GV.SC to establish and run a C-SCRM capability (checklist)
• Defining and communicating supplier requirements with the CSF

What a school district should take from it

• Much district data lives with vendors, so supplier risk is a core part of district cybersecurity.
• Security and privacy requirements are easiest to enforce when they are written into contracts before signing.

How to use it in your district

1. Keep a vendor inventory that records what data each vendor holds and how critical it is.
2. Add security and privacy questions to procurement for any product that stores student or staff data.
3. Require a signed data privacy agreement before student data is shared.
4. Review critical vendors yearly and plan for what happens if one is breached or goes offline.

Common misconceptions

A vendor's SOC 2 report or marketing page settles the question.

It is one input. The district still decides what risk is acceptable and writes requirements into the contract.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

• GV.SCCybersecurity Supply Chain Risk Management

Tools in the program portal

• Vendor RegistryKnow which vendors hold district data
• Student data privacy agreementsTrack a signed agreement for every vendor that receives student data
• Guide: Vendor data privacy agreementsPublic guide
• Policy BuilderDraft policy language tied to rubric categories

Related publications

• CSF 2.0 (CSWP 29)Cybersecurity Framework 2.0