Assessment Objective
Determine if:
- SR-03a.
- SR-03a.[01] a process or processes is/are established to identify and address weaknesses or deficiencies in the supply chain elements and processes of [Assignment: system or system component];
- SR-03a.[02] the process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes of [Assignment: system or system component] is/are coordinated with [Assignment: supply chain personnel];
- SR-03b. [Assignment: supply chain controls] are employed to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events;
- SR-03c. the selected and implemented supply chain processes and controls are documented in [Selection (one or more): security and privacy plans; supply chain risk management plan; [Assignment: document] ].
Assessment Methods
Examine
- Supply chain risk management policy
- supply chain risk management procedures
- supply chain risk management strategy
- supply chain risk management plan
- systems and critical system components inventory documentation
- system and services acquisition policy
- system and services acquisition procedures
- procedures addressing the integration of information security and privacy requirements into the acquisition process
- solicitation documentation
- acquisition documentation (including purchase orders)
- service level agreements
- acquisition contracts for systems or services
- risk register documentation
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with acquisition responsibilities
- organizational personnel with information security and privacy responsibilities
- organizational personnel with supply chain risk management responsibilities
Test
- Organizational processes for identifying and addressing supply chain element and process deficiencies
Gekoppelde issues
| Koppelingstype | Issue |
|---|---|
| blocks | SR-03 [H] Supply Chain Controls and Processes |