Assessment Objective

Determine if:

• acquisition strategies, contract tools, and procurement methods are developed to identify supply chain risks.
• acquisition strategies, contract tools, and procurement methods are developed to protect against supply chain risks.
• acquisition strategies, contract tools, and procurement methods are developed to mitigate supply chain risks.
• acquisition strategies, contract tools, and procurement methods are implemented to identify supply chain risks.
• acquisition strategies, contract tools, and procurement methods are implemented to protect against supply chain risks.
• acquisition strategies, contract tools, and procurement methods are implemented to mitigate supply chain risks.

Assessment Methods

Examine

• SCRM policy and procedures
• SCRM plan
• system and services acquisition policy and procedures
• procedures for supply chain protection
• procedures for the integration of information security requirements into the acquisition process
• solicitation documentation
• acquisition documentation (including purchase orders)
• service-level agreements
• acquisition contracts for the system, system components, or services
• documentation of identified supply chain risks
• mitigation plans for supply chain risks
• documentation of training, education, and awareness programs for personnel regarding supply chain risk
• system security plan
• other relevant documents or records

Interview

• personnel with acquisition responsibilities
• personnel with SCRM responsibilities
• personnel with information security responsibilities

Test

• processes for defining and employing tailored acquisition strategies, contract tools, and procurement methods
• mechanisms for implementing tailored acquisition strategies, contract tools, and procurement methods

Ticket collegati

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final