Identify 2.2.6 Supply chain risk management Determine priorities, constraints, and the maximum risks that your organisation is willing to accept in connection with supplier-related risks. Description Task ID.SC-1 Establish clear procedures to manage supply chain risks. Have these procedures reviewed and agreed by all of the stakeholders involved. ID.SC-2 Identify and prioritise the suppliers and service-providers for your critical systems, components and services, using the procedures defined under ID.SC-1. ID.SC-3 Place your suppliers and service-providers under a contractual obligation to develop and implement appropriate measures to meet the objectives and requirements of the supply chain risk management process. ID.SC-4 Establish a system of monitoring to ensure that all of your suppliers and service-providers are fulfilling their obligations as required. Have this confirmed on a regular basis by audit reports or technical test results. ID.SC-5 Work with your suppliers and service-providers to define response and recovery procedures following cybersecurity incidents. Conduct drills to test these procedures. Table 13: ID.SC tasks Standard Reference COBIT 5 APO10.01, APO10.02, APO10.04, APO10.05, APO12.01, APO12.02, APO12.03, APO12.04, APO12.05, APO12.06, APO13.02, BAI02.03, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05 ISA 62443-3:2013 4.2.3.1, 4.2.3.2, 4.2.3.3, 4.2.3.4, 4.2.3.6, 4.2.3.8, 4.2.3.9, 4.2.3.10, 4.2.3.12, 4.2.3.13, 4.2.3.14, 4.3.2.6., 4.3.2.5.7, 4.3.4.5.11 7 ISO 27001:2013 A.15.1.1, A.15.1.2, A.15.1.3, A.15.2.1, A.15.2.2, A.15.2.1, A.15.2.2, A.17.1.3 NIST-SP-800-53 Rev. 4 SA-9, SA-12, PM-9, RA-2, RA-3, SA-12, SA-14, SA-15, SA-11, CP-2, CP-4, IR-3, IR-4, IR-6, IR-8, IR-9 BSI B 1.11, B 1.17, M 2.256, B 1.3 Table 14: ID.SC references Minimum ICT standard 2018 20