03.17.02 Acquisition Strategies, Tools, and Methods

Statement

Develop and implement acquisition strategies, contract tools, and procurement methods to identify, protect against, and mitigate supply chain risks.

Guidance

The acquisition process provides an important vehicle for protecting the supply chain. There are many useful tools and techniques available, including obscuring the end use of a system or system component, using blind purchases, requiring tamperevident packaging, or using trusted or controlled distribution. The results from a supply chain risk assessment can inform the strategies, tools, and methods that are most applicable to the situation. Tools and techniques may provide protections against unauthorized production, theft, tampering, the insertion of counterfeits, the insertion of malicious software or backdoors, and poor development practices throughout the system life cycle. Organizations also consider providing incentives for suppliers to implement safeguards, promote transparency in their processes and security practices, provide contract language that addresses the prohibition of tainted or counterfeit components, and restrict purchases from untrustworthy suppliers. Organizations consider providing training, education, and awareness programs for personnel regarding supply chain risks, available mitigation strategies, and when the programs should be employed. Methods for reviewing and protecting development plans, documentation, and evidence are commensurate with the security requirements of the organization. Contracts may specify documentation protection requirements.

Assessment objective

acquisition strategies, contract tools, and procurement methods are developed to identify supply chain risks.

Assessment objective

acquisition strategies, contract tools, and procurement methods are developed to protect against supply chain risks.

Assessment objective

acquisition strategies, contract tools, and procurement methods are developed to mitigate supply chain risks.

Assessment objective

acquisition strategies, contract tools, and procurement methods are implemented to identify supply chain risks.

Assessment objective

acquisition strategies, contract tools, and procurement methods are implemented to protect against supply chain risks.

Assessment objective

acquisition strategies, contract tools, and procurement methods are implemented to mitigate supply chain risks.

Assessment method

• SCRM policy and procedures SCRM plan system and services acquisition policy and procedures procedures for supply chain protection procedures for the integration of information security requirements into the acquisition process solicitation documentation acquisition documentation (including purchase orders) service-level agreements acquisition contracts for the system, system components, or services documentation of identified supply chain risks mitigation plans for supply chain risks documentation of training, education, and awareness programs for personnel regarding supply chain risk system security plan other relevant documents or records

Assessment method

• personnel with acquisition responsibilities personnel with SCRM responsibilities personnel with information security responsibilities

Assessment method

• processes for defining and employing tailored acquisition strategies, contract tools, and procurement methods mechanisms for implementing tailored acquisition strategies, contract tools, and procurement methods

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

3. Regolamentazioni correlate

Ticket collegati

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final