Assessment Objective
Determine if:
- RA-03(01)(a) supply chain risks associated with [Assignment: systems, system components, and system services] are assessed;
- RA-03(01)(b) the supply chain risk assessment is updated [Assignment: frequency] , when there are significant changes to the relevant supply chain, or when changes to the system, environments of operation, or other conditions may necessitate a change in the supply chain.
Assessment Methods
Examine
- Supply chain risk management policy
- inventory of critical systems, system components, and system services
- risk assessment policy
- security planning policy and procedures
- procedures addressing organizational assessments of supply chain risk
- risk assessment
- risk assessment results
- risk assessment reviews
- risk assessment updates
- acquisition policy
- system security plan
- supply chain risk management plan
- other relevant documents or records
Interview
- Organizational personnel with risk assessment responsibilities
- organizational personnel with security responsibilities
- organizational personnel with supply chain risk management responsibilities
Test
- Organizational processes for risk assessment
- mechanisms supporting and/or conducting, documenting, reviewing, disseminating, and updating the supply chain risk assessment
Saincheisteanna nasctha
| Cineál naisc | Saincheist |
|---|---|
| blocks | RA-03(01) [M] Supply Chain Risk Assessment |