Assessment Objective

Determine if:

• SR-04(02)[01] the unique identification of [Assignment: systems and critical system components] is established for tracking through the supply chain;
• SR-04(02)[02] the unique identification of [Assignment: systems and critical system components] is maintained for tracking through the supply chain.

Assessment Methods

Examine

• Supply chain risk management policy and procedures
• system and services acquisition policy
• procedures addressing supply chain protection
• procedures addressing the integration of information security requirements into the acquisition process
• supply chain risk management plan
• list of supply chain elements, processes, and actors (associated with the system, system component, or system service) requiring implementation of unique identification processes, procedures, tools, mechanisms, equipment, techniques, and/or configurations
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with system and services acquisition responsibilities
• organizational personnel with information security responsibilities
• organizational personnel with supply chain protection responsibilities
• organizational personnel with responsibilities for establishing and retaining the unique identification of supply chain elements, processes, and actors

Test

• Organizational processes for defining, establishing, and retaining unique identification for supply chain elements, processes, and actors
• mechanisms supporting and/or implementing the definition, establishment, and retention of unique identification for supply chain elements, processes, and actors

Gekoppelde issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final