Assessment Objective
Determine if:
- SR-07 [Assignment: OPSEC controls] are employed to protect supply chain-related information for the system, system component, or system service.
Assessment Methods
Examine
- Supply chain risk management plan
- supply chain risk management procedures
- system and services acquisition policy
- system and services acquisition procedures
- procedures addressing supply chain protection
- list of OPSEC controls to be employed
- solicitation documentation
- acquisition documentation
- acquisition contracts for the system, system component, or system service
- records of all-source intelligence analyses
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with acquisition responsibilities
- organizational personnel with information security and privacy responsibilities
- organizational personnel with OPSEC responsibilities
- organizational personnel with supply chain risk management responsibilities
Test
- Organizational processes for defining and employing OPSEC safeguards
- mechanisms supporting and/or implementing the definition and employment of OPSEC safeguards
Gekoppelde issues
| Koppelingstype | Issue |
|---|---|
| blocks | SR-07 Supply Chain Operations Security |