+SR [L] Supply Chain Risk Management
---+SR-01 [L] Policy and Procedures
---+SR-02 [L] Supply Chain Risk Management Plan
------+SR-02(01) [L] Establish SCRM Team
---+SR-03 [L] Supply Chain Controls and Processes
---+SR-05 [L] Acquisition Strategies, Tools, and Methods
---+SR-08 [L] Notification Agreements
---+SR-10 [L] Inspection of Systems or Components
---+SR-11 [L] Component Authenticity
------+SR-11(01) [L] Anti-counterfeit Training
------+SR-11(02) [L] Configuration Control for Component Service and Repair
---+SR-12 [L] Component Disposal

SR [L] Supply Chain Risk Management

Supply Chain Risk Management

1. Ħarsa ġenerali

SR-01 [L] Policy and Procedures

Control

  1. Develop, document, and disseminate to [Assignement: organization-defined personnel or roles]:
    1. [Selection(one-or-more): organization-level; mission/business process-level; system-level] supply chain risk management policy that:
      1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
      2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
    2. Procedures to facilitate the implementation of the supply chain risk management policy and the associated supply chain risk management controls;
  2. Designate an [Assignement: official] to manage the development, documentation, and dissemination of the supply chain risk management policy and procedures; and
  3. Review and update the current supply chain risk management:
    1. Policy [Assignement: frequency] and following [Assignement: events] ; and
    2. Procedures [Assignement: frequency] and following [Assignement: events].

Discussion

Supply chain risk management policy and procedures address the controls in the SR family as well as supply chain-related controls in other families that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of supply chain risk management policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to supply chain risk management policy and procedures include assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure.

Assessment Objective

    1. a supply chain risk management policy is developed and documented;
    2. the supply chain risk management policy is disseminated to [Assignement: personnel or roles];
    3. supply chain risk management procedures to facilitate the implementation of the supply chain risk management policy and the associated supply chain risk management controls are developed and documented;
    4. the supply chain risk management procedures are disseminated to [Assignement: personnel or roles].
        1. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] supply chain risk management policy addresses purpose;
        2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] supply chain risk management policy addresses scope;
        3. [Selection(one-or-more): organization-level; mission/business process-level; system-level] supply chain risk management policy addresses roles;
        4. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] supply chain risk management policy addresses responsibilities;
        5. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] supply chain risk management policy addresses management commitment;
        6. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] supply chain risk management policy addresses coordination among organizational entities;
        7. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] supply chain risk management policy addresses compliance.
      2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] supply chain risk management policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
  2. the [Assignement: official] is designated to manage the development, documentation, and dissemination of the supply chain risk management policy and procedures;
      1. the current supply chain risk management policy is reviewed and updated [Assignement: frequency];
      2. the current supply chain risk management policy is reviewed and updated following [Assignement: events];
      1. the current supply chain risk management procedures are reviewed and updated [Assignement: frequency];
      2. the current supply chain risk management procedures are reviewed and updated following [Assignement: events].

Assessment Method

Examine

Supply chain risk management policy supply chain risk management procedures system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with supply chain risk management responsibilities organizational personnel with information security and privacy responsibilities organizational personnel with acquisition responsibilities organizational personnel with enterprise risk management responsibilities
SR-02 [L] Supply Chain Risk Management Plan

Control

  1. Develop a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal of the following systems, system components or system services: [Assignement: systems, system components, or system services];
  2. Review and update the supply chain risk management plan [Assignement: frequency] or as required, to address threat, organizational or environmental changes; and
  3. Protect the supply chain risk management plan from unauthorized disclosure and modification.

Discussion

The dependence on products, systems, and services from external providers, as well as the nature of the relationships with those providers, present an increasing level of risk to an organization. Threat actions that may increase security or privacy risks include unauthorized production, the insertion or use of counterfeits, tampering, theft, insertion of malicious software and hardware, and poor manufacturing and development practices in the supply chain. Supply chain risks can be endemic or systemic within a system element or component, a system, an organization, a sector, or the Nation. Managing supply chain risk is a complex, multifaceted undertaking that requires a coordinated effort across an organization to build trust relationships and communicate with internal and external stakeholders. Supply chain risk management (SCRM) activities include identifying and assessing risks, determining appropriate risk response actions, developing SCRM plans to document response actions, and monitoring performance against plans. The SCRM plan (at the system-level) is implementation specific, providing policy implementation, requirements, constraints and implications. It can either be stand-alone, or incorporated into system security and privacy plans. The SCRM plan addresses managing, implementation, and monitoring of SCRM controls and the development/sustainment of systems across the SDLC to support mission and business functions. Because supply chains can differ significantly across and within organizations, SCRM plans are tailored to the individual program, organizational, and operational contexts. Tailored SCRM plans provide the basis for determining whether a technology, service, system component, or system is fit for purpose, and as such, the controls need to be tailored accordingly. Tailored SCRM plans help organizations focus their resources on the most critical mission and business functions based on mission and business requirements and their risk environment. Supply chain risk management plans include an expression of the supply chain risk tolerance for the organization, acceptable supply chain risk mitigation strategies or controls, a process for consistently evaluating and monitoring supply chain risk, approaches for implementing and communicating the plan, a description of and justification for supply chain risk mitigation measures taken, and associated roles and responsibilities. Finally, supply chain risk management plans address requirements for developing trustworthy, secure, privacy-protective, and resilient system components and systems, including the application of the security design principles implemented as part of life cycle-based systems security engineering processes (see [SA-8](#sa-8)).

Assessment Objective

    1. a plan for managing supply chain risks is developed;
    2. the supply chain risk management plan addresses risks associated with the research and development of [Assignement: systems, system components, or system services];
    3. the supply chain risk management plan addresses risks associated with the design of [Assignement: systems, system components, or system services];
    4. the supply chain risk management plan addresses risks associated with the manufacturing of [Assignement: systems, system components, or system services];
    5. the supply chain risk management plan addresses risks associated with the acquisition of [Assignement: systems, system components, or system services];
    6. the supply chain risk management plan addresses risks associated with the delivery of [Assignement: systems, system components, or system services];
    7. the supply chain risk management plan addresses risks associated with the integration of [Assignement: systems, system components, or system services];
    8. the supply chain risk management plan addresses risks associated with the operation and maintenance of [Assignement: systems, system components, or system services];
    9. the supply chain risk management plan addresses risks associated with the disposal of [Assignement: systems, system components, or system services];
  2. the supply chain risk management plan is reviewed and updated [Assignement: frequency] or as required to address threat, organizational, or environmental changes;
    1. the supply chain risk management plan is protected from unauthorized disclosure;
    2. the supply chain risk management plan is protected from unauthorized modification.

Assessment Method

Examine

Supply chain risk management policy supply chain risk management procedures supply chain risk management plan system and services acquisition policy system and services acquisition procedures procedures addressing supply chain protection procedures for protecting the supply chain risk management plan from unauthorized disclosure and modification system development life cycle procedures procedures addressing the integration of information security and privacy requirements into the acquisition process acquisition documentation service level agreements acquisition contracts for the system, system component, or system service list of supply chain threats list of safeguards to be taken against supply chain threats system life cycle documentation inter-organizational agreements and procedures system security plan privacy plan privacy program plan other relevant documents or records

Interview

Organizational personnel with acquisition responsibilities organizational personnel with information security and privacy responsibilities organizational personnel with supply chain risk management responsibilities
SR-03 [L] Supply Chain Controls and Processes

Control

  1. Establish a process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes of [Assignement: system or system component] in coordination with [Assignement: supply chain personnel];
  2. Employ the following controls to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events: [Assignement: supply chain controls] ; and
  3. Document the selected and implemented supply chain processes and controls in [Selection(one-or-more): security and privacy plans; supply chain risk management plan; {{ insert: param, sr-03_odp.05 }} ].

Discussion

Supply chain elements include organizations, entities, or tools employed for the research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal of systems and system components. Supply chain processes include hardware, software, and firmware development processes; shipping and handling procedures; personnel security and physical security programs; configuration management tools, techniques, and measures to maintain provenance; or other programs, processes, or procedures associated with the development, acquisition, maintenance and disposal of systems and system components. Supply chain elements and processes may be provided by organizations, system integrators, or external providers. Weaknesses or deficiencies in supply chain elements or processes represent potential vulnerabilities that can be exploited by adversaries to cause harm to the organization and affect its ability to carry out its core missions or business functions. Supply chain personnel are individuals with roles and responsibilities in the supply chain.

Assessment Objective

    1. a process or processes is/are established to identify and address weaknesses or deficiencies in the supply chain elements and processes of [Assignement: system or system component];
    2. the process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes of [Assignement: system or system component] is/are coordinated with [Assignement: supply chain personnel];
  2. [Assignement: supply chain controls] are employed to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events;
  3. the selected and implemented supply chain processes and controls are documented in [Selection(one-or-more): security and privacy plans; supply chain risk management plan; {{ insert: param, sr-03_odp.05 }} ].

Assessment Method

Examine

Supply chain risk management policy supply chain risk management procedures supply chain risk management strategy supply chain risk management plan systems and critical system components inventory documentation system and services acquisition policy system and services acquisition procedures procedures addressing the integration of information security and privacy requirements into the acquisition process solicitation documentation acquisition documentation (including purchase orders) service level agreements acquisition contracts for systems or services risk register documentation system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with acquisition responsibilities organizational personnel with information security and privacy responsibilities organizational personnel with supply chain risk management responsibilities
SR-05 [L] Acquisition Strategies, Tools, and Methods

Control

Employ the following acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks: [Assignement: strategies, tools, and methods].

Discussion

The use of the acquisition process provides an important vehicle to protect the supply chain. There are many useful tools and techniques available, including obscuring the end use of a system or system component, using blind or filtered buys, requiring tamper-evident packaging, or using trusted or controlled distribution. The results from a supply chain risk assessment can guide and inform the strategies, tools, and methods that are most applicable to the situation. Tools and techniques may provide protections against unauthorized production, theft, tampering, insertion of counterfeits, insertion of malicious software or backdoors, and poor development practices throughout the system development life cycle. Organizations also consider providing incentives for suppliers who implement controls, promote transparency into their processes and security and privacy practices, provide contract language that addresses the prohibition of tainted or counterfeit components, and restrict purchases from untrustworthy suppliers. Organizations consider providing training, education, and awareness programs for personnel regarding supply chain risk, available mitigation strategies, and when the programs should be employed. Methods for reviewing and protecting development plans, documentation, and evidence are commensurate with the security and privacy requirements of the organization. Contracts may specify documentation protection requirements.

Assessment Objective

  1. [Assignement: strategies, tools, and methods] are employed to protect against supply chain risks;
  2. [Assignement: strategies, tools, and methods] are employed to identify supply chain risks;
  3. [Assignement: strategies, tools, and methods] are employed to mitigate supply chain risks.

Assessment Method

Examine

Supply chain risk management policy supply chain risk management procedures supply chain risk management plan system and services acquisition policy system and services acquisition procedures procedures addressing supply chain protection procedures addressing the integration of information security and privacy requirements into the acquisition process solicitation documentation acquisition documentation (including purchase orders) service level agreements acquisition contracts for systems, system components, or services documentation of training, education, and awareness programs for personnel regarding supply chain risk system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with acquisition responsibilities organizational personnel with information security and privacy responsibilities organizational personnel with supply chain risk management responsibilities
SR-08 [L] Notification Agreements

Control

Establish agreements and procedures with entities involved in the supply chain for the system, system component, or system service for the [Selection(one-or-more): notification of supply chain compromises; {{ insert: param, sr-08_odp.02 }} ].

Discussion

The establishment of agreements and procedures facilitates communications among supply chain entities. Early notification of compromises and potential compromises in the supply chain that can potentially adversely affect or have adversely affected organizational systems or system components is essential for organizations to effectively respond to such incidents. The results of assessments or audits may include open-source information that contributed to a decision or result and could be used to help the supply chain entity resolve a concern or improve its processes.

Assessment Objective

agreements and procedures are established with entities involved in the supply chain for the system, system components, or system service for [Selection(one-or-more): notification of supply chain compromises; {{ insert: param, sr-08_odp.02 }} ].

Assessment Method

Examine

Supply chain risk management policy and procedures supply chain risk management plan system and services acquisition policy procedures addressing supply chain protection acquisition documentation service level agreements acquisition contracts for the system, system component, or system service inter-organizational agreements and procedures system security plan other relevant documents or records

Interview

Organizational personnel with system and service acquisition responsibilities organizational personnel with information security responsibilities organizational personnel with supply chain risk management responsibilities
SR-10 [L] Inspection of Systems or Components

Control

Inspect the following systems or system components [Selection(one-or-more): at random; at {{ insert: param, sr-10_odp.03 }} ; upon {{ insert: param, sr-10_odp.04 }} ] to detect tampering: [Assignement: systems or system components].

Discussion

The inspection of systems or systems components for tamper resistance and detection addresses physical and logical tampering and is applied to systems and system components removed from organization-controlled areas. Indications of a need for inspection include changes in packaging, specifications, factory location, or entity in which the part is purchased, and when individuals return from travel to high-risk locations.

Assessment Objective

[Assignement: systems or system components] are inspected [Selection(one-or-more): at random; at {{ insert: param, sr-10_odp.03 }} ; upon {{ insert: param, sr-10_odp.04 }} ] to detect tampering.

Assessment Method

Examine

Supply chain risk management policy and procedures supply chain risk management plan system and services acquisition policy records of random inspections inspection reports/results assessment reports/results acquisition documentation service level agreements acquisition contracts for the system, system component, or system service inter-organizational agreements and procedures system security plan other relevant documents or records

Interview

Organizational personnel with system and services acquisition responsibilities organizational personnel with information security responsibilities organizational personnel with supply chain risk management responsibilities
SR-11 [L] Component Authenticity

Control

  1. Develop and implement anti-counterfeit policy and procedures that include the means to detect and prevent counterfeit components from entering the system; and
  2. Report counterfeit system components to [Selection(one-or-more): source of counterfeit component; {{ insert: param, sr-11_odp.02 }} ; {{ insert: param, sr-11_odp.03 }} ].

Discussion

Sources of counterfeit components include manufacturers, developers, vendors, and contractors. Anti-counterfeiting policies and procedures support tamper resistance and provide a level of protection against the introduction of malicious code. External reporting organizations include CISA.

Assessment Objective

    1. an anti-counterfeit policy is developed and implemented;
    2. anti-counterfeit procedures are developed and implemented;
    3. the anti-counterfeit procedures include the means to detect counterfeit components entering the system;
    4. the anti-counterfeit procedures include the means to prevent counterfeit components from entering the system;
  2. counterfeit system components are reported to [Selection(one-or-more): source of counterfeit component; {{ insert: param, sr-11_odp.02 }} ; {{ insert: param, sr-11_odp.03 }} ].

Assessment Method

Examine

Supply chain risk management policy and procedures supply chain risk management plan system and services acquisition policy anti-counterfeit plan anti-counterfeit policy and procedures media disposal policy media protection policy incident response policy reports notifying developers, manufacturers, vendors, contractors, and/or external reporting organizations of counterfeit system components acquisition documentation service level agreements acquisition contracts for the system, system component, or system service inter-organizational agreements and procedures records of reported counterfeit system components system security plan other relevant documents or records

Interview

Organizational personnel with system and service acquisition responsibilities organizational personnel with information security responsibilities organizational personnel with supply chain risk management responsibilities organizational personnel with responsibilities for anti-counterfeit policies, procedures, and reporting
SR-12 [L] Component Disposal

Control

Dispose of [Assignement: data, documentation, tools, or system components] using the following techniques and methods: [Assignement: techniques and methods].

Discussion

Data, documentation, tools, or system components can be disposed of at any time during the system development life cycle (not only in the disposal or retirement phase of the life cycle). For example, disposal can occur during research and development, design, prototyping, or operations/maintenance and include methods such as disk cleaning, removal of cryptographic keys, partial reuse of components. Opportunities for compromise during disposal affect physical and logical data, including system documentation in paper-based or digital files; shipping and delivery documentation; memory sticks with software code; or complete routers or servers that include permanent media, which contain sensitive or proprietary information. Additionally, proper disposal of system components helps to prevent such components from entering the gray market.

Assessment Objective

[Assignement: data, documentation, tools, or system components] are disposed of using [Assignement: techniques and methods].

Assessment Method

Examine

Supply chain risk management policy and procedures supply chain risk management plan disposal procedures addressing supply chain protection media disposal policy media protection policy disposal records for system components documentation of the system components identified for disposal documentation of the disposal techniques and methods employed for system components system security plan other relevant documents or records

Interview

Organizational personnel with system component disposal responsibilities organizational personnel with information security responsibilities organizational personnel with supply chain protection responsibilities

1.1 Referenzi

1.2 Rekwiżiti identifikati

1.3 Regolamenti relatati

2. Rekwiżiti identifikati

Rekwiżiti

3. Regolamenti relatati

Regolamenti