GRCLibrary.ai

Supplier and cloud dependency

How exposed are we through the parties we depend on?

3 leadership pages, 26 governing documents. Can we withstand what hits us?

Most organizations now run on other people's infrastructure, software, and models. The exposure is concentration you have not measured, exits you have not rehearsed, and assurance you have taken on a supplier's word, discovered, typically, on the day a critical supplier fails.

Note

Adopting a page here decides nothing for you. The leadership pages linked here are explanatory and advisory; they establish no requirement and prove nothing about your organization. Every claim in them resolves to the governing reference documents in the corpus, and it is those documents that govern.

Leadership

The leadership pages

Pages from the executive layer mapped to this concern, generated from the narrative registry. They explain and advise; the documents below govern.

Documents

The governing documents

The evidence shelf: the corpus documents the pages above resolve to, joined to the library's registries at build time. These are the documents that govern, and the evidence to ask for starts here.

Frameworks

Frameworks touched

The external frameworks the shelf above maps, from the corpus registry. The documents' framework spellings are normalized against the crosswalk's committed alias maps: every spelling that names a crosswalk instrument, whole or by a clause, appears once as the instrument's short label and links its instrument page; a cited text that names no instrument is shown as plain text.

  • AEO/AEO-S
  • BASC
  • CER Directive (EU) 2022/2557 of 14 December 2022 Article 15 (critical entities)
  • China Cybersecurity Law Article 27
  • China Cybersecurity Law Articles 27 and 44 para. 2
  • China Data Security Law Article 29 (data security incidents; unofficial DigiChina English translation of the law in force 1 September 2021)
  • CISA SBOM guidance
  • Cloud Security Alliance (CSA)
  • COBIT
  • Commission Delegated Regulation (EU) 2025/301 of 23 October 2024 Article 5 (time limits for DORA major-incident reports)
  • CSA AI Model Risk Management Framework (2024)
  • CSA AICM
  • CSA CCM
  • CSA STAR
  • CTPAT
  • Cybersecurity Law Art. 44 para. 2 and, where the incident also endangers network security, Art. 27 (amended numbering, in force 1 January 2026)
  • CycloneDX
  • CycloneDX / SPDX
  • Datasheets for datasets
  • Digital Personal Data Protection Rules 2025
  • DORA
  • DORA RTS (EU) 2025/532
  • DPBI
  • DPDPA 2023
  • EBA Guidelines on outsourcing arrangements
  • EDPB Guidelines 07/2020 on the concepts of controller and processor in the GDPR, Version 2.1 (adopted 7 July 2021)
  • EDPB Guidelines 9/2022 (Version 2.0) paragraphs 78 to 80 and Annex B example (i)
  • EDPB Guidelines 9/2022 on personal data breach notification (Version 2.0) paragraph 118
  • ETSI EN 304 223 V2.1.1
  • ETSI TR 104 128 V1.1.1 (2025-05)
  • EU AI Act
  • EU Cyber Resilience Act
  • EU Data Act (Regulation (EU) 2023/2854), Chapter VI: Switching between data processing services
  • EU GPAI Code of Practice (Safety and Security Chapter, July 2025)
  • FISMA 2014 (44 U.S.C. 3553 note) for federal agencies
  • FSB Cyber Lexicon and Third-Party Risk Toolkit
  • G7 Hiroshima Process International Code of Conduct (2023)
  • GC Cyber Security Event Management Plan §2.3.1.4 (held text: date modified 2026-05-20, cited at the edition held, currency to be confirmed upstream)
  • GDPR
  • IEEE 2883-2022
  • ISO 22301:2019
  • ISO 28000:2022
  • ISO 31000
  • ISO/IEC 20000-1:2018
  • ISO/IEC 23894:2023
  • ISO/IEC 27001
  • ISO/IEC 27002
  • ISO/IEC 27018:2025 A.10.1 (notification of a data breach involving PII)
  • ISO/IEC 27035-1:2023
  • ISO/IEC 27035-1:2023, ISO/IEC 27035-2:2023
  • ISO/IEC 27035-2:2023
  • ISO/IEC 27035-3:2020
  • ISO/IEC 27035-4:2024 (Part 4: Coordination)
  • ISO/IEC 27036
  • ISO/IEC 27036-2:2022
  • ISO/IEC 27036-3:2023
  • ISO/IEC 27037:2012 §5.4.1
  • ISO/IEC 27701
  • ISO/IEC 38507:2022
  • ISO/IEC 42001
  • ISO/IEC 42006:2025
  • ISO/IEC 5230 (OpenChain)
  • ISO/IEC 5338:2023
  • ISO/IEC 8183:2023
  • ISO/IEC TR 27563:2023
  • Law No. 6698 (KVKK) Art. 12(5)
  • LGPD
  • MITRE ATLAS
  • Model card pattern
  • NIS 2
  • NIST AI 100-2e2025
  • NIST AI 100-4
  • NIST AI 600-1 (Generative AI Profile)
  • NIST AI RMF
  • NIST CSF
  • NIST IR 8286D-upd1 (Using Business Impact Analysis to Inform Risk Prioritization and Response)
  • NIST Privacy Framework
  • NIST SP 800-111 §§3.1.1 and 3.2 (pre-boot authentication)
  • NIST SP 800-124 Rev. 2 §4.3.3 (remote wipe scope and its limits as a sole control)
  • NIST SP 800-161 Rev. 1
  • NIST SP 800-218 Version 1.1
  • NIST SP 800-218A
  • NIST SP 800-37 Rev. 2
  • NIST SP 800-53
  • NIST SP 800-61 Rev. 3
  • NIST SP 800-84
  • NIST SP 800-88 Rev. 2
  • NIST SSDF
  • NTIA Minimum Elements of a Software Bill of Materials
  • OECD AI Principles
  • OECD Recommendation on Critical Information Infrastructure Protection
  • Ontario FIPPA s. 40.1 (in force since 2025-07-01)
  • Ontario MFIPPA s. 30.1 (not yet in force; comes into force 2027-01-01)
  • OSFI Guideline E-23 (2025, effective 2027)
  • OWASP AI Exchange
  • OWASP Dependency-Check
  • OWASP LLM Top 10
  • PIPEDA Breach of Security Safeguards Regulations (successor Bill C-36/PPCDA proposed, not in force)
  • PIPL
  • Quebec Law 25
  • SANS CAISG v1.4
  • SANS Critical AI Security Guidelines v1.4 (March 2026), Incident Response and Forensics for AI Systems
  • SLSA
  • SLSA v1.2 Framework
  • SPDX
  • US Executive Order 14028
  • UU PDP (Law No. 27 of 2022) Art. 46
  • VEX
  • WCO SAFE

Go deeper

The domains behind it