Assessment Objective
Determine if:
- PM-30(01)[01] suppliers of critical or mission-essential technologies, products, and services are identified;
- PM-30(01)[02] suppliers of critical or mission-essential technologies, products, and services are prioritized;
- PM-30(01)[03] suppliers of critical or mission-essential technologies, products, and services are assessed.
Assessment Methods
Examine
- Supply chain risk management strategy
- organization-wide risk management strategy
- enterprise risk management documents
- inventory records or suppliers
- assessment and prioritization documentation
- critical or mission-essential technologies, products, and service documents or records
- other relevant documents or records
Interview
- Organizational personnel with supply chain risk management responsibilities
- organizational personnel with information security responsibilities
- organizational personnel with acquisition responsibilities
- organizational personnel with enterprise risk management responsibilities
Test
- Organizational processes for identifying, prioritizing, and assessing critical or mission-essential technologies, products, and services
- organizational processes for maintaining an inventory of suppliers
- organizational process for associating suppliers with critical or mission-essential technologies, products, and services
Verknüpfte Vorgänge
| Verknüpfungstyp | Vorgang |
|---|---|
| blocks | PM-30(01) Suppliers of Critical or Mission-essential Items |