03.17.01E Notification Agreements

Statement

Establish agreements and procedures with entities involved in the supply chain for the system, system component, or system service for the {{ insert: param, A.03.17.01E.ODP.01 }}.

Guidance

Establishing agreements and procedures facilitates communications among supply chain entities. Early notification of compromises and potential compromises in the supply chain that may adversely affect or have adversely affected organizational systems or system components is essential for organizations to effectively respond to such incidents. The results of assessments or audits may include open-source information that contributed to a decision or result and could be used to help the supply chain entity resolve a concern or improve its processes. This requirement is sourced to a control tailored out of the SP 800-53B .13 moderate baseline in SP 800-171.

Statement

• (includes detect) Reduce risk due to ignorance of threat events and possible replicated or similar threat events in the same or similar environments.

  • Reduce likelihood of impact.

  • The adversary loses the advantage of stealth as defenders are better prepared by developing and sharing threat intelligence.

• (includes shorten and reduce) Restrict the consequences of realized threat events by limiting the damage or effects they cause in terms of time, system resources, and/or mission or business impacts.

  • Reduce level of impact and reduce likelihood of impact of subsequent events in the same threat scenario.

  • The adversary’s effectiveness is restricted.

Assessment objective

agreements and procedures are established with entities involved in the supply chain for the system, system components, or system service for {{ insert: param, A.03.17.01E.ODP.01 }}.

Assessment method

• Supply chain risk management policy and procedures supply chain risk management plan system and services acquisition policy acquisition contracts for the system, system component, or system service procedures addressing supply chain protection acquisition documentation service-level agreements system security plan inter-organizational agreements and procedures other relevant documents or records

Assessment method

• Personnel with system and service acquisition responsibilities personnel with information security responsibilities personnel with supply chain risk management responsibilities

Assessment method

• Processes for establishing inter-organizational agreements and procedures with supply chain entities

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

3. Zugehörige Regulierungen

Verknüpfte Vorgänge

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final