+RA-03(01) [L] Supply Chain Risk Assessment

RA-03(01) [L] Supply Chain Risk Assessment

Control

  1. Assess supply chain risks associated with [Assignement: systems, system components, and system services] ; and
  2. Update the supply chain risk assessment [Assignement: frequency] , when there are significant changes to the relevant supply chain, or when changes to the system, environments of operation, or other conditions may necessitate a change in the supply chain.

Discussion

Supply chain-related events include disruption, use of defective components, insertion of counterfeits, theft, malicious development practices, improper delivery practices, and insertion of malicious code. These events can have a significant impact on the confidentiality, integrity, or availability of a system and its information and, therefore, can also adversely impact organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation. The supply chain-related events may be unintentional or malicious and can occur at any point during the system life cycle. An analysis of supply chain risk can help an organization identify systems or components for which additional supply chain risk mitigations are required.

Assessment Objective

  1. supply chain risks associated with [Assignement: systems, system components, and system services] are assessed;
  2. the supply chain risk assessment is updated [Assignement: frequency] , when there are significant changes to the relevant supply chain, or when changes to the system, environments of operation, or other conditions may necessitate a change in the supply chain.

Assessment Method

Examine

Supply chain risk management policy inventory of critical systems, system components, and system services risk assessment policy security planning policy and procedures procedures addressing organizational assessments of supply chain risk risk assessment risk assessment results risk assessment reviews risk assessment updates acquisition policy system security plan supply chain risk management plan other relevant documents or records

Interview

Organizational personnel with risk assessment responsibilities organizational personnel with security responsibilities organizational personnel with supply chain risk management responsibilities

1. Přehled

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

Požadavky

3. Související regulace

Regulace

Propojené úkoly

Vazby
is blocked by RA-03(01) [L] Supply Chain Risk Assessment – Assessment Procedure
is blocked by Supply Chain Risk Assessment (SCRA)