Meeting the Third-Party Risk Requirements of NIST CSF in 2026 | UpGuard

**Executive summary:** This article outlines NIST CSF 2.0—emphasizing the new Govern (GV) function and Cybersecurity Supply Chain Risk Management (GV.SC) subcategories—and maps specific third‑party risk management practices (attack surface monitoring, vendor tiering, security assessments/questionnaires, security ratings, and regular penetration testing) to those controls while highlighting how UpGuard’s products can help implement them.