Assessment Objective
Determine if:
- SR-03(03) the controls included in the contracts of prime contractors are also included in the contracts of subcontractors.
Assessment Methods
Examine
- Supply chain risk management policy and procedures
- supply chain risk management plan
- system and services acquisition policy
- procedures addressing supply chain protection
- acquisition documentation
- service level agreements
- acquisition contracts for the system, system component, or system service
- inter-organizational agreements and procedures
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with system and services acquisition responsibilities
- organizational personnel with information security responsibilities
- organizational personnel with supply chain risk management responsibilities
Test
- Organizational processes for establishing inter-organizational agreements and procedures with supply chain entities
Saincheisteanna nasctha
| Cineál naisc | Saincheist |
|---|---|
| blocks | SR-03(03) Sub-tier Flow Down |