Assessment Objective
Determine if:
- SR-06 the supply chain-related risks associated with suppliers or contractors and the systems, system components, or system services they provide are assessed and reviewed [Assignment: frequency].
Assessment Methods
Examine
- Supply chain risk management policy and procedures
- supply chain risk management strategy
- supply chain risk management plan
- system and services acquisition policy
- procedures addressing supply chain protection
- procedures addressing the integration of information security requirements into the acquisition process
- records of supplier due diligence reviews
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with system and services acquisition responsibilities
- organizational personnel with information security responsibilities
- organizational personnel with supply chain protection responsibilities
Test
- Organizational processes for conducting supplier reviews
- mechanisms supporting and/or implementing supplier reviews
Gekoppelde issues
| Koppelingstype | Issue |
|---|---|
| blocks | SR-06 [H] Supplier Assessments and Reviews |