Assessment Objective

Determine if:

• a process for identifying weaknesses or deficiencies in the supply chain elements and processes is established.
• a process for addressing weaknesses or deficiencies in the supply chain elements and processes is established.
• the following security requirements are enforced to protect against supply chain risks to the system, system components, or system services and to limit the harm or consequences of supply chain-related events: [Assignment: security requirements].

Assessment Methods

Examine

• SCRM policy and procedures
• SCRM strategy
• SCRM plan
• systems and critical system components inventory documentation
• system and services acquisition policy and procedures
• procedures for the integration of security requirements into the acquisition process
• solicitation documentation
• acquisition documentation (including purchase orders)
• shipping and handling procedures
• configuration management documentation and records
• acquisition contracts for systems or services
• service-level agreements
• risk register documentation
• system security plan
• other relevant documents or records

Interview

• personnel with acquisition responsibilities
• personnel with information security responsibilities
• personnel with SCRM responsibilities

Test

• processes for identifying and addressing supply chain element and process deficiencies

Ticket collegati

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final