Authority-to-resilience workflow crosswalk

The authority records

NIST SP 800-161 Rev. 1

Organizations managing cybersecurity risks in technology products and services · Final publication with updates through November 2024. The publication integrates cybersecurity supply-chain risk management into enterprise risk activities and provides strategy, plan, assessment, and control guidance.

ISO 22301:2019

Organizations choosing to implement a business continuity management system · Published international standard; a new edition is under development. ISO 22301 specifies requirements for a management system intended to prepare for, respond to, and recover from disruptions.

ISO 22316:2017

Organizations seeking principles for resilience · Published international standard. ISO 22316 provides principles and attributes for organizational resilience rather than a certifiable requirements system.

ISO 28000:2022

Organizations managing security risks including supply-chain activities · Published international standard. ISO 28000 specifies requirements for a security management system relevant to organizations and supply chains.

ISO 31000:2018

Organizations designing risk-management processes · Published international standard. ISO 31000 provides principles and guidelines for integrating risk management into governance, strategy, planning, and operations.

ISO 20400:2017

Organizations integrating sustainability into procurement · Published international standard. ISO 20400 provides guidance for integrating sustainability into procurement policy, strategy, process, and supplier relationships.

ISO 44001:2017

Organizations managing collaborative business relationships · Published international standard. ISO 44001 specifies requirements for identifying, developing, managing, and exiting collaborative business relationships.

OECD Due Diligence Guidance

Multinational enterprises and organizations applying responsible-business due diligence · Published guidance. The guidance describes risk-based due diligence across policies, impact identification, prevention and mitigation, tracking, communication, and remediation.

UN Guiding Principles

States and business enterprises addressing human-rights impacts · Endorsed principles. The principles describe the state duty to protect, corporate responsibility to respect human rights, and access to remedy.

EU CSDDD

Companies within the directive's scope and phased application as transposed by Member States · Directive in force with revised timeline and scope following 2026 changes. The directive establishes a corporate due-diligence framework for specified human-rights and environmental impacts across defined chains of activities.

EU Deforestation Regulation

Operators and traders placing or exporting covered commodities and products, subject to scope and timing · Regulation in force with implementation dates and guidance subject to current official texts. The regulation creates due-diligence and geolocation duties for specified commodities and products associated with deforestation and legality criteria.

EU Forced Labour Regulation

Products placed or made available on the EU market or exported from the EU, under the regulation's investigation and enforcement structure · Regulation in force with later application date. The regulation establishes an EU framework to investigate and prohibit products made with forced labour.

CISA ICT SCRM Resources

Organizations managing ICT supply-chain risk · Active guidance resources. CISA maintains ICT supply-chain risk resources developed with public and private stakeholders.

UFLPA Strategy

Importers and supply chains subject to UFLPA and customs enforcement · Active strategy and entity-list program. The strategy describes enforcement, entity listing, risk assessment, and importer guidance under UFLPA.

WCO SAFE Framework

Customs administrations and authorized economic operator programs adopting the framework · Current framework maintained by WCO. The framework sets customs-to-customs, customs-to-business, and customs-to-other-government cooperation principles for secure and facilitated trade.

The operating-domain lens

Demand uncertainty and plan governance

The operating discipline for translating uncertain demand signals into time-bounded plans, assumptions, scenarios, decisions, and accountable changes. The crosswalk links 5 capabilities and 2 authority records.

Supply, capacity, and constraint decisions

The system for connecting supply, production, materials, capacity, lead time, policy, and customer priorities into executable allocation choices. The crosswalk links 5 capabilities and 2 authority records.

Inventory, service, and working-capital tradeoffs

The decision system for setting inventory policy and replenishment against uncertain demand, supply variability, service objectives, expiration, cost, and network constraints. The crosswalk links 5 capabilities and 2 authority records.

Multi-tier dependency and supplier exposure

The evidence system for relating companies, facilities, products, materials, ownership, tiers, geographies, and critical dependencies without overstating inferred relationships. The crosswalk links 6 capabilities and 3 authority records.

Logistics visibility and event integrity

The operating system for preserving the identity, source, timestamp, expected sequence, latency, correction, and uncertainty of order and shipment events across partners and modes. The crosswalk links 7 capabilities and 2 authority records.

Disruption detection and materiality

The decision process for connecting a sourced event to potentially affected suppliers, facilities, products, lanes, time horizons, and operating consequences. The crosswalk links 7 capabilities and 3 authority records.

Disruption response and business continuity

The maintained capacity to assess disruption, select response options, coordinate decisions, sustain critical flows, recover within defined objectives, and learn from exercises and events. The crosswalk links 6 capabilities and 3 authority records.

Responsible sourcing and regulatory due diligence

The governed process for identifying supply-chain entities and impacts, prioritizing risk, engaging partners, preventing and mitigating harm, tracking action, communicating, and supporting remediation under defined standards and laws. The crosswalk links 6 capabilities and 6 authority records.

Network data and model governance

The control system for identities, source lineage, access, quality, transformations, assumptions, models, versions, and human overrides across planning and visibility decisions. The crosswalk links 6 capabilities and 2 authority records.

How to use the crosswalk

Determine applicability with qualified owners, identify affected records and workflows, map each expectation to an accountable decision and retained evidence, then use capability and organization pages to frame a technology evaluation. A mapping is editorial navigation—not a conformity or legal conclusion.

Methodology

1. Define the market boundary, exclusions, operating models, and capability taxonomy before classifying organizations.
2. Require an approved official source for organization inclusion and each documented capability.
3. Keep authority sources, provider claims, independent observations, editorial synthesis, and unknowns in separate evidence states.
4. Use one primary operating model per organization while retaining adjacent scope in the narrative record.
5. Preserve source URLs, review dates, material changes, limitations, and correction history.

Limitations

• The maintained population is substantial but not claimed to be a complete global market.
• Official public documentation may omit available capabilities or lag product and service changes.
• Documented positioning does not measure product depth, configured availability, independent performance, implementation effort, customer outcome, or commercial terms.
• Authority mappings are editorial research aids and do not establish buyer-specific applicability or product conformity.
• No organization may purchase inclusion, classification, finding, or correction outcome.

Reproducibility and updates

The report is reproduced from the provider registry, normalized facts and evidence, authority and domain records, and the publication taxonomy. A material change requires a dated source and editorial explanation. Historical values remain available through the change ledger rather than disappearing when the current record changes.