03.17 Supply Chain Risk Management

Statement

• a. Develop a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations, maintenance, and disposal of the system, system components, or system services.

• b. Review and update the supply chain risk management plan {{ insert: param, A.03.17.01.ODP.01 }}.

• c. Protect the supply chain risk management plan from unauthorized disclosure.

Guidance

Dependence on the products, systems, and services of external providers and the nature of the relationships with those providers present an increasing level of risk to an organization. Threat actions that may increase security risks include unauthorized production, the insertion or use of counterfeits, tampering, poor manufacturing and development practices in the supply chain, theft, and the insertion of malicious software, firmware, and hardware. Supply chain risks can be endemic or systemic within a system, component, or service. Managing supply chain risks is a complex, multifaceted undertaking that requires a coordinated effort across an organization to build trust relationships and communicate with internal and external stakeholders. Supply chain risk management (SCRM) activities include identifying and assessing risks, determining appropriate risk response actions, developing SCRM plans to document response actions, and monitoring performance against the plans. The system-level SCRM plan is implementation-specific and provides constraints, policy implementation, requirements, and implications. It can either be stand-alone or incorporated into system security plans. The SCRM plan addresses the management, implementation, and monitoring of SCRM requirements and the development or sustainment of systems across the system development life cycle to support mission and business functions. Because supply chains can differ significantly across and within organizations, SCRM plans are tailored to individual program, organizational, and operational contexts.

Assessment objective

a plan for managing supply chain risks is developed.

Assessment objective

the SCRM plan addresses risks associated with the research and development of the system, system components, or system services.

Assessment objective

the SCRM plan addresses risks associated with the design of the system, system components, or system services.

Assessment objective

the SCRM plan addresses risks associated with the manufacturing of the system, system components, or system services.

Assessment objective

the SCRM plan addresses risks associated with the acquisition of the system, system components, or system services.

Assessment objective

the SCRM plan addresses risks associated with the delivery of the system, system components, or system services.

Assessment objective

the SCRM plan addresses risks associated with the integration of the system, system components, or system services.

Assessment objective

the SCRM plan addresses risks associated with the operation of the system, system components, or system services.

Assessment objective

the SCRM plan addresses risks associated with the maintenance of the system, system components, or system services.

Assessment objective

the SCRM plan addresses risks associated with the disposal of the system, system components, or system services.

Assessment objective

the SCRM plan is reviewed {{ insert: param, A.03.17.01.ODP.01 }}.

Assessment objective

the SCRM plan is updated {{ insert: param, A.03.17.01.ODP.01 }}.

Assessment objective

the SCRM plan is protected from unauthorized disclosure.

Assessment method

• SCRM policy and procedures SCRM plan system and services acquisition policy and procedures system and services acquisition procedures procedures for supply chain protection procedures for protecting the SCRM plan from unauthorized disclosure system development life cycle procedures procedures for the integration of information security requirements into the acquisition process acquisition documentation service-level agreements acquisition contracts for the system, system components, or system services list of supply chain threats list of safeguards for supply chain threats system life cycle documentation, including research and development, design, manufacturing, acquisition, delivery, integration, operations, maintenance, and disposal inter-organizational agreements and procedures system security plan other relevant documents or records

Assessment method

• personnel with acquisition responsibilities personnel with SCRM responsibilities personnel with information security responsibilities

Assessment method

• organizational processes for defining and documenting the system development life cycle (SDLC) organizational processes for identifying SDLC roles and responsibilities organizational processes for integrating SCRM into the SDLC mechanisms for supporting or implementing the SDLC

Statement

Develop and implement acquisition strategies, contract tools, and procurement methods to identify, protect against, and mitigate supply chain risks.

Guidance

The acquisition process provides an important vehicle for protecting the supply chain. There are many useful tools and techniques available, including obscuring the end use of a system or system component, using blind purchases, requiring tamperevident packaging, or using trusted or controlled distribution. The results from a supply chain risk assessment can inform the strategies, tools, and methods that are most applicable to the situation. Tools and techniques may provide protections against unauthorized production, theft, tampering, the insertion of counterfeits, the insertion of malicious software or backdoors, and poor development practices throughout the system life cycle. Organizations also consider providing incentives for suppliers to implement safeguards, promote transparency in their processes and security practices, provide contract language that addresses the prohibition of tainted or counterfeit components, and restrict purchases from untrustworthy suppliers. Organizations consider providing training, education, and awareness programs for personnel regarding supply chain risks, available mitigation strategies, and when the programs should be employed. Methods for reviewing and protecting development plans, documentation, and evidence are commensurate with the security requirements of the organization. Contracts may specify documentation protection requirements.

Assessment objective

acquisition strategies, contract tools, and procurement methods are developed to identify supply chain risks.

Assessment objective

acquisition strategies, contract tools, and procurement methods are developed to protect against supply chain risks.

Assessment objective

acquisition strategies, contract tools, and procurement methods are developed to mitigate supply chain risks.

Assessment objective

acquisition strategies, contract tools, and procurement methods are implemented to identify supply chain risks.

Assessment objective

acquisition strategies, contract tools, and procurement methods are implemented to protect against supply chain risks.

Assessment objective

acquisition strategies, contract tools, and procurement methods are implemented to mitigate supply chain risks.

Assessment method

• SCRM policy and procedures SCRM plan system and services acquisition policy and procedures procedures for supply chain protection procedures for the integration of information security requirements into the acquisition process solicitation documentation acquisition documentation (including purchase orders) service-level agreements acquisition contracts for the system, system components, or services documentation of identified supply chain risks mitigation plans for supply chain risks documentation of training, education, and awareness programs for personnel regarding supply chain risk system security plan other relevant documents or records

Assessment method

• personnel with acquisition responsibilities personnel with SCRM responsibilities personnel with information security responsibilities

Assessment method

• processes for defining and employing tailored acquisition strategies, contract tools, and procurement methods mechanisms for implementing tailored acquisition strategies, contract tools, and procurement methods

Statement

• a. Establish a process for identifying and addressing weaknesses or deficiencies in the supply chain elements and processes.

• b. Enforce the following security requirements to protect against supply chain risks to the system, system components, or system services and to limit the harm or consequences from supply chain-related events: {{ insert: param, A.03.17.03.ODP.01 }}.

Guidance

Supply chain elements include organizations, entities, or tools that are employed for the research, development, design, manufacturing, acquisition, delivery, integration, operations, maintenance, and disposal of systems and system components. Supply chain processes include hardware, software, firmware, and systems development processes; shipping and handling procedures; physical security programs; personnel security programs; configuration management tools, techniques, and measures to maintain provenance; or other programs, processes, or procedures associated with the development, acquisition, maintenance, and disposal of systems and system components. Supply chain elements and processes are provided by organizations, system integrators, or external service providers. Weaknesses or deficiencies in supply chain elements or processes represent potential vulnerabilities that can be exploited by adversaries to harm the organization and affect its ability to carry out its core missions or business functions.

Assessment objective

a process for identifying weaknesses or deficiencies in the supply chain elements and processes is established.

Assessment objective

a process for addressing weaknesses or deficiencies in the supply chain elements and processes is established.

Assessment objective

the following security requirements are enforced to protect against supply chain risks to the system, system components, or system services and to limit the harm or consequences of supply chain-related events: {{ insert: param, A.03.17.03.ODP.01 }}.

Assessment method

• SCRM policy and procedures SCRM strategy SCRM plan systems and critical system components inventory documentation system and services acquisition policy and procedures procedures for the integration of security requirements into the acquisition process solicitation documentation acquisition documentation (including purchase orders) shipping and handling procedures configuration management documentation and records acquisition contracts for systems or services service-level agreements risk register documentation system security plan other relevant documents or records

Assessment method

• personnel with acquisition responsibilities personnel with information security responsibilities personnel with SCRM responsibilities

Assessment method

• processes for identifying and addressing supply chain element and process deficiencies