03.17.03 Supply Chain Requirements and Processes

Statement

• a. Establish a process for identifying and addressing weaknesses or deficiencies in the supply chain elements and processes.

• b. Enforce the following security requirements to protect against supply chain risks to the system, system components, or system services and to limit the harm or consequences from supply chain-related events: {{ insert: param, A.03.17.03.ODP.01 }}.

Guidance

Supply chain elements include organizations, entities, or tools that are employed for the research, development, design, manufacturing, acquisition, delivery, integration, operations, maintenance, and disposal of systems and system components. Supply chain processes include hardware, software, firmware, and systems development processes; shipping and handling procedures; physical security programs; personnel security programs; configuration management tools, techniques, and measures to maintain provenance; or other programs, processes, or procedures associated with the development, acquisition, maintenance, and disposal of systems and system components. Supply chain elements and processes are provided by organizations, system integrators, or external service providers. Weaknesses or deficiencies in supply chain elements or processes represent potential vulnerabilities that can be exploited by adversaries to harm the organization and affect its ability to carry out its core missions or business functions.

Assessment objective

a process for identifying weaknesses or deficiencies in the supply chain elements and processes is established.

Assessment objective

a process for addressing weaknesses or deficiencies in the supply chain elements and processes is established.

Assessment objective

the following security requirements are enforced to protect against supply chain risks to the system, system components, or system services and to limit the harm or consequences of supply chain-related events: {{ insert: param, A.03.17.03.ODP.01 }}.

Assessment method

• SCRM policy and procedures SCRM strategy SCRM plan systems and critical system components inventory documentation system and services acquisition policy and procedures procedures for the integration of security requirements into the acquisition process solicitation documentation acquisition documentation (including purchase orders) shipping and handling procedures configuration management documentation and records acquisition contracts for systems or services service-level agreements risk register documentation system security plan other relevant documents or records

Assessment method

• personnel with acquisition responsibilities personnel with information security responsibilities personnel with SCRM responsibilities

Assessment method

• processes for identifying and addressing supply chain element and process deficiencies

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

3. Zugehörige Regulierungen

Verknüpfte Vorgänge

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final