Core
Six functions
Govern, Identify, Protect, Detect, Respond and Recover, each broken into categories and outcomes.
Supply chain outcomes under NIST CSF 2.0, kept on record
The NIST Cybersecurity Framework 2.0 is voluntary guidance from the US National Institute of Standards and Technology, released in February 2024. It is used well beyond the US to organise cybersecurity around outcomes, and it places supply chain risk under its new Govern function.
Montro keeps the supplier side of those outcomes in one register, with each supplier’s owner, how critical it is, and the decisions taken as it changes.
Framework
Three parts of the framework
CSF 2.0 isn’t certified and sets no fixed controls. It describes outcomes, helps you see where you stand, and lets you decide how far to go.
Profiles
Current and target profiles
A profile records where you stand on each outcome today and where you want to be, so the gap becomes a plan.
Tiers
Four tiers, from Partial to Adaptive
Tiers describe how formal and responsive your approach to cybersecurity risk is, and help you set the level you’re aiming for.
How Montro helps
Supply chain outcomes with evidence behind them
GV.SC describes what good supply chain risk management looks like. Montro keeps the record that shows it happening, supplier by supplier.
Suppliers known and ranked
Suppliers arrive as candidates from your sign-in, finance and cloud data, and your team sets each one’s owner and how critical it is.
Requirements written into contracts
The security requirements each contract sets out are recorded against the supplier, so you can see which suppliers have them and which don’t yet.
Risks followed through the relationship
A new sub-processor, a lapsed certificate or AI switched on is raised with its source, checked with the supplier and decided by its owner.
What you get
What your profile can point to
Evidence for the supply chain rows of your current profile.
Due diligence
Checks before a supplier is approved
The due diligence done before a supplier is approved stays with its entry, alongside the decision it led to.
Incidents
Suppliers in your incident plans
Critical suppliers’ contacts and responsibilities are on record, so incident and recovery plans can draw on them.
Endings
When a relationship ends
A supplier no longer in use is raised so the exit can be planned and recorded, with its history kept.
Supply chain
Supply chain risk is now a governance job
CSF 2.0 moved supply chain risk out of Identify and into the new Govern function, with ten outcomes from setting up a programme to planning what happens after a relationship ends. That makes it a leadership responsibility, shared with procurement, legal and privacy, not only the security team.
Because Govern sits with leadership, Montro gives them a view they can stand behind: which critical suppliers changed, what was decided and who decided it, without reading every entry.
FAQs
Questions about NIST CSF 2.0, and how Montro supports its supply chain outcomes.
No. CSF 2.0 is voluntary guidance with no certification. Organisations use it to assess themselves and report to boards and customers, often alongside a certified standard such as ISO 27001.
Customers and parent companies often ask for it, and many teams use it as a shared language with their board. It maps across to ISO 27001, underpins Belgium’s CyFun, and can help organise the measures NIS2 asks for, though it doesn’t replace them.
Version 1.1 had five supply chain outcomes under Identify. Version 2.0 has ten, under the new Govern function, adding planning before a relationship starts and after it ends.
NIST’s quick-start guide on supply chain risk suggests starting by knowing your suppliers and ranking them by how critical they are. That’s the register a 30-day pilot builds from your own systems.
Not directly. NIST covers AI in its separate AI Risk Management Framework, which can be used alongside CSF. AI services from suppliers still fall under GV.SC like any other supplier.
Keep reading
Frameworks that map to CSF 2.0
CSF outcomes line up with several European rules and standards. These are the closest.
Third-party records are becoming decision logs. The firms that get this right will be the ones that can show who decided, on what evidence, and when.
- Pen-test summary on request
- Frankfurt hosting
- Sample register
- Expert Series guests
- Cyber Ireland member
See it on your own suppliers
A read-only connection, about an hour to set up, and a named person who can say yes to a decision.
Priced to scope — never per seat, never per supplier. Upgrade only when the evidence earns it.
