Assessment Objective

Determine if:

• SR-04(01)[01] unique identification of [Assignment: supply chain elements, processes, and personnel] is established;
• SR-04(01)[02] unique identification of [Assignment: supply chain elements, processes, and personnel] is maintained.

Assessment Methods

Examine

• Supply chain risk management policy and procedures
• supply chain risk management plan
• system and services acquisition policy
• procedures addressing supply chain protection
• procedures addressing the integration of information security requirements into the acquisition process
• list of supply chain elements, processes, and actors (associated with the system, system component, or system service) requiring implementation of unique identification processes, procedures, tools, mechanisms, equipment, techniques, and/or configurations
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with system and services acquisition responsibilities
• organizational personnel with information security responsibilities
• organizational personnel with supply chain protection responsibilities
• organizational personnel with responsibilities for establishing and retaining the unique identification of supply chain elements, processes, and actors

Test

• Organizational processes for defining, establishing, and retaining unique identification for supply chain elements, processes, and actors
• mechanisms supporting and/or implementing the definition, establishment, and retention of unique identification for supply chain elements, processes, and actors

Propojené úkoly

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final