KSI-SCR-MIT Mitigating Supply Chain Risk

Potential supply chain risks are persistently identified, reviewed, and mitigated.

NIST SP 800-53 Rev. 5 controls: AC-19, AC-20, CA-7(4), RA-3, RA-3(1), SA-10, SA-11, SA-11(1), SA-11(2), SA-15, SA-15(3), SA-16, SA-17, SA-21, SA-22, SA-4, SA-4(1), SA-4(2), SA-4(5), SA-4(9), SA-9, SA-9(1), SA-9(2), SA-9(5), SC-18, SI-7(1), SI-7(15), SR-2, SR-3, SR-5, SR-6

Defined terms: Persistently

1. Overview

1.1 References

• AC-19 Access Control for Mobile Devices
• AC-20 Use of External Systems
• CA-07(04) Risk Monitoring
• RA-03 Risk Assessment
• RA-03(01) Supply Chain Risk Assessment
• SA-10 Developer Configuration Management
• SA-11 Developer Testing and Evaluation
• SA-11(01) Static Code Analysis
• SA-11(02) Threat Modeling and Vulnerability Analyses
• SA-15 Development Process, Standards, and Tools
• SA-15(03) Criticality Analysis
• SA-16 Developer-provided Training
• SA-17 Developer Security and Privacy Architecture and Design
• SA-21 Developer Screening
• SA-22 Unsupported System Components
• SA-04 Acquisition Process
• SA-04(01) Functional Properties of Controls
• SA-04(02) Design and Implementation Information for Controls
• SA-04(05) System, Component, and Service Configurations
• SA-04(09) Functions, Ports, Protocols, and Services in Use
• SA-09 External System Services
• SA-09(01) Risk Assessments and Organizational Approvals
• SA-09(02) Identification of Functions, Ports, Protocols, and Services
• SA-09(05) Processing, Storage, and Service Location
• SC-18 Mobile Code
• SI-07(01) Integrity Checks
• SI-07(15) Code Authentication
• SR-02 Supply Chain Risk Management Plan
• SR-03 Supply Chain Controls and Processes
• SR-05 Acquisition Strategies, Tools, and Methods
• SR-06 Supplier Assessments and Reviews
• FRD-PER Persistently

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

3. Related Regulations

• FedRAMP Consolidated Rules -

  EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.

  DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.