Vendor & supply-chain register
Third parties that process your data or that your systems depend on — each rated for impact and on a reassessment cadence, so supply-chain risk is governed, not assumed. NIST SP 800-161 CSF GV.SC A High/Critical vendor that is never assessed, or one overdue for reassessment, is flagged on the POA&M.
0
Vendors
0
High/Critical
0
Review overdue
0
Unassessed (H/C)
+ Add a vendor
| ID | Vendor | Criticality | Data / access | Status | Next review |
|---|---|---|---|---|---|
| No vendors yet — add one above. | |||||
Export — ⇩ vendors.csv