Assessment Objective
Determine if:
- SR-11(02)[01] configuration control over [Assignment: system components] awaiting service or repair is maintained;
- SR-11(02)[02] configuration control over serviced or repaired [Assignment: system components] awaiting return to service is maintained.
Assessment Methods
Examine
- Supply chain risk management policy and procedures
- supply chain risk management plan
- configuration control procedures
- acquisition documentation
- service level agreements
- acquisition contracts for the system component
- inter-organizational agreements and procedures
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with system and services acquisition responsibilities
- organizational personnel with information security responsibilities
- organizational personnel with supply chain risk management responsibilities
Test
- Organizational processes for establishing inter-organizational agreements and procedures with supply chain entities
- organizational configuration control processes
Συνδεδεμένα ζητήματα
| Τύπος σύνδεσης | Ζήτημα |
|---|---|
| blocks | SR-11(02) [H] Configuration Control for Component Service and Repair |