Law / Frameworks / NIST CSF 2.0 / Govern

NIST CSF 2.0, GovernGV.SC-07

The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationshipNIST Cybersecurity Framework, version 2.0, February 2024 (NIST CSWP 29), GV.SC-07

We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of 14 Nov 2026.

16: laws
11: jurisdictions
0: with court rulings behind them
1: not yet in force

Related controls in other frameworks the same duties, in at least two laws we track, reach both

NIST Privacy FrameworkID.DE-P5 Data processing ecosystem parties are routinely assessed using audits, test..., 3 laws
NIST Privacy FrameworkID.DE-P2 Data processing ecosystem parties (e.g., service providers, customers,..., 2 laws

A law in force is unmarked; the rest wear their state: not yet in force

Sector security regimes

13 laws, 8 jurisdictions

Jurisdiction	Law	What it asks, as read here
Canada	OSFI Guideline B-10, Third-Party Risk Management	Manage the risks of all your third-party arrangements, which include outsourced activities, brokers, utilities, financial market infrastructures, affiliates and other relationships involving goods, services or the storage, use or exchange of data, such as cloud service providers, managed service providers and technology companies that deliver financial services; you retain accountability for business activities, functions and services outsourced to a third party. Identify, monitor and manage the risk arising from subcontracting arrangements that your third parties undertake.
Estonia	Küberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties	Where you delegate management of your system to another person, or host it with another person, you remain responsible for ensuring that person applies the security measures.
European Union	Commission Delegated Regulation (EU) 2022/1645, Information Security Management System for Design, Production and Aerodrome Organizations (Part-IS.D.OR)	When you contract out any part of these activities, ensure that the contracted activities comply with the Regulation, that the contracted organization works under your oversight, and that the risks of the contracted activities are managed (point IS.D.OR.235(a)).
European Union	Commission Implementing Regulation (EU) 2023/203, Information Security Management System for Aviation Organizations (Part-IS.I.OR)	When you contract out any part of these activities, ensure that the contracted activities comply with the Regulation, that the contracted organization works under your oversight, and that the risks of the contracted activities are managed (point IS.I.OR.235(a)).
Kiribati	Cybersecurity Act 2026, Critical Infrastructure Operator Obligations from a date not yet set	Establish, implement and maintain a cybersecurity risk-management framework, and take reasonable contractual, technical and organisational measures to manage cybersecurity risk arising from your third-party suppliers, service providers and contractors.
Malta	Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, Risk-Management Measures for Essential and Important Entities	When choosing supply chain measures, take into account the vulnerabilities specific to each direct supplier and service provider and the overall quality of its products and cybersecurity practices, including its secure development procedures (article 19(3)).
Netherlands	Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details	Record a supply-chain security policy and check periodically that your direct suppliers and service providers meet your security requirements (Article 10).
New York	DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models	The Department says you should develop and maintain dependency maps, coordinate with your critical third-party service providers and material downstream providers to address significant vulnerabilities and operational risks, and monitor and validate third-party code and engage with critical providers, including to communicate the specific responsibilities of each side.
New York	DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks	The Department says your risk assessment should address AI-related risks in your own use of AI, in the AI technologies your third-party service providers and vendors use, and in any vulnerabilities stemming from AI applications that could affect your information systems or nonpublic information.
New York	DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation	The Department says your risk assessment should evaluate risks associated with third-party service providers by the criticality of the services provided, the sensitivity of the information accessed or maintained, the level of connectivity to your information systems and the potential operational impact if the provider experiences an incident or disruption, and should identify single points of failure and assess concentration risk.

Show the other 3 laws

New York	DFS Guidance: Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment	The Department says you should consider enhancing monitoring and validation of the expected behavior of third-party code, applications, permissions and practices, and engaging with critical third-party service providers to confirm awareness of heightened cybersecurity risks and readiness to respond to potential disruptions.
New York	New York Department of Financial Services Cybersecurity Regulation, Third-Party Service Provider Security Policy	Address in those policies, to the extent applicable: the identification and risk assessment of third-party service providers; the minimum cybersecurity practices they must meet to do business with you; the due diligence you use to evaluate the adequacy of their cybersecurity practices; and periodic assessment of them based on the risk they present and the continued adequacy of their practices.
Poland	Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions	Tell the Komisja Nadzoru Finansowego how you have taken into account the risk identified in a recommendation to a critical ICT third-party service provider you contract with, in particular any change to the contract (Article 18zl).

Security baseline statutes

2 laws, 2 jurisdictions

Jurisdiction	Law	What it asks, as read here
Israel	Privacy Protection Regulations (Data Security), information security programme	Where an external service provider is given access to the database, agree in writing on the data and systems it may access, its reporting and data-destruction duties, and monitor its compliance.
North Carolina	Identity Theft Protection Act, destruction of personal information records	Where a records-destruction vendor is used, conduct due diligence before contracting with it, such as reviewing an independent audit of the vendor's operations, checking its trade certification, or evaluating its information-security procedures, and monitor its ongoing compliance.

Vulnerability and incident reporting

1 law, 1 jurisdiction

Jurisdiction	Law	What it asks, as read here
Finland	Laki sosiaali- ja terveydenhuollon asiakastietojen käsittelystä, Reporting of Deviations in Information Systems and Wellbeing Applications and of Significant Information Security Disturbances	If you are a service provider or a pharmacy and detect a significant deviation in how an information system meets the essential requirements, notify the information system service provider (section 90).

Full text of the NIST Cybersecurity Framework, public domain (a US government work). Every control of the framework.