Assessment Objective
Determine if:
- PM-30a.
- PM-30a.[01] an organization-wide strategy for managing supply chain risks is developed;
- PM-30a.[02] the supply chain risk management strategy addresses risks associated with the development of systems;
- PM-30a.[03] the supply chain risk management strategy addresses risks associated with the development of system components;
- PM-30a.[04] the supply chain risk management strategy addresses risks associated with the development of system services;
- PM-30a.[05] the supply chain risk management strategy addresses risks associated with the acquisition of systems;
- PM-30a.[06] the supply chain risk management strategy addresses risks associated with the acquisition of system components;
- PM-30a.[07] the supply chain risk management strategy addresses risks associated with the acquisition of system services;
- PM-30a.[08] the supply chain risk management strategy addresses risks associated with the maintenance of systems;
- PM-30a.[09] the supply chain risk management strategy addresses risks associated with the maintenance of system components;
- PM-30a.[10] the supply chain risk management strategy addresses risks associated with the maintenance of system services;
- PM-30a.[11] the supply chain risk management strategy addresses risks associated with the disposal of systems;
- PM-30a.[12] the supply chain risk management strategy addresses risks associated with the disposal of system components;
- PM-30a.[13] the supply chain risk management strategy addresses risks associated with the disposal of system services;
- PM-30b. the supply chain risk management strategy is implemented consistently across the organization;
- PM-30c. the supply chain risk management strategy is reviewed and updated [Assignment: frequency] or as required to address organizational changes.
Assessment Methods
Examine
- Supply chain risk management strategy
- organizational risk management strategy
- enterprise risk management documents
- other relevant documents or records
Interview
- Organizational personnel with supply chain risk management responsibilities
- organizational personnel with information security responsibilities
- organizational personnel with acquisition responsibilities
- organizational personnel with enterprise risk management responsibilities
Incidencias vinculadas
| Tipo de vínculo | Incidencia |
|---|---|
| blocks | PM-30 Supply Chain Risk Management Strategy |