Assessment Objective

Determine if:

• valid provenance is documented for [Assignment: systems, system components, and associated CUI].
• valid provenance is monitored for [Assignment: systems, system components, and associated CUI].
• valid provenance is maintained for [Assignment: systems, system components, and associated CUI].

Assessment Methods

Examine

• Supply chain risk management policy
• supply chain risk management procedures
• supply chain risk management plan
• documentation of critical systems, critical system components, and associated data
• documentation showing the history of ownership, custody, and location of and changes to critical systems or critical system components
• system architecture
• inter-organizational agreements and procedures
• contracts
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with acquisition responsibilities
• organizational personnel with information security responsibilities
• organizational personnel with supply chain risk management responsibilities

Test

• Organizational processes for identifying the provenance of critical systems and critical system components
• mechanisms used to document, monitor, or maintain provenance

Propojené úkoly

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final