Assessment Objective
Determine if:
- SR-02a.
- SR-02a.[01] a plan for managing supply chain risks is developed;
- SR-02a.[02] the supply chain risk management plan addresses risks associated with the research and development of [Assignment: systems, system components, or system services];
- SR-02a.[03] the supply chain risk management plan addresses risks associated with the design of [Assignment: systems, system components, or system services];
- SR-02a.[04] the supply chain risk management plan addresses risks associated with the manufacturing of [Assignment: systems, system components, or system services];
- SR-02a.[05] the supply chain risk management plan addresses risks associated with the acquisition of [Assignment: systems, system components, or system services];
- SR-02a.[06] the supply chain risk management plan addresses risks associated with the delivery of [Assignment: systems, system components, or system services];
- SR-02a.[07] the supply chain risk management plan addresses risks associated with the integration of [Assignment: systems, system components, or system services];
- SR-02a.[08] the supply chain risk management plan addresses risks associated with the operation and maintenance of [Assignment: systems, system components, or system services];
- SR-02a.[09] the supply chain risk management plan addresses risks associated with the disposal of [Assignment: systems, system components, or system services];
- SR-02b. the supply chain risk management plan is reviewed and updated [Assignment: frequency] or as required to address threat, organizational, or environmental changes;
- SR-02c.
- SR-02c.[01] the supply chain risk management plan is protected from unauthorized disclosure;
- SR-02c.[02] the supply chain risk management plan is protected from unauthorized modification.
Assessment Methods
Examine
- Supply chain risk management policy
- supply chain risk management procedures
- supply chain risk management plan
- system and services acquisition policy
- system and services acquisition procedures
- procedures addressing supply chain protection
- procedures for protecting the supply chain risk management plan from unauthorized disclosure and modification
- system development life cycle procedures
- procedures addressing the integration of information security and privacy requirements into the acquisition process
- acquisition documentation
- service level agreements
- acquisition contracts for the system, system component, or system service
- list of supply chain threats
- list of safeguards to be taken against supply chain threats
- system life cycle documentation
- inter-organizational agreements and procedures
- system security plan
- privacy plan
- privacy program plan
- other relevant documents or records
Interview
- Organizational personnel with acquisition responsibilities
- organizational personnel with information security and privacy responsibilities
- organizational personnel with supply chain risk management responsibilities
Test
- Organizational processes for defining and documenting the system development life cycle (SDLC)
- organizational processes for identifying SDLC roles and responsibilities
- organizational processes for integrating supply chain risk management into the SDLC
- mechanisms supporting and/or implementing the SDLC
Gekoppelde issues
| Koppelingstype | Issue |
|---|---|
| blocks | SR-02 [L] Supply Chain Risk Management Plan |