Assessment Objectives

In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:

• TPM-21.1_A01 security requirements to be satisfied by external system service providers are defined.
  Defined parameters: notification of supply chain compromises and results of assessment or audits
  Assessment rigor: 1
  Origin: 53A_R5_SR-08_ODP[01] 53A_R5_SR-08_ODP[02]
• TPM-21.1_A02 agreements and procedures are established with entities involved in the supply chain for the system, system components or system service per organization-defined criteria.
  Defined parameters: notification of supply chain compromises and results of assessment or audits
  Assessment rigor: 1
  Origin: 53A_R5_SR-08
• TPM-21.1_A03 External Service Providers (ESPs) are contractually obligated to provide notification of actual or potential compromises in the supply chain that can potentially affect or have adversely affected systems, applications and/or services that the organization utilizes.
  Defined parameters: no more than 24 hours after the third-party's discovery, or sooner where law or contract requires
  Assessment rigor: 1
  Origin: SCF Created

Saistītie uzdevumi

• Secure Controls Framework -

  EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.

  DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.