Assessment Objective
Determine if:
- IR-04(10) incident handling activities involving supply chain events are coordinated with other organizations involved in the supply chain.
Assessment Methods
Examine
- Incident response policy
- procedures addressing supply chain coordination and supply chain risk information sharing with the Federal Acquisition Security Council
- acquisition contracts
- service-level agreements
- incident response plan
- supply chain risk management plan
- system security plan
- incident response plans of other organization involved in supply chain activities
- other relevant documents or records
Interview
- Organizational personnel with incident handling responsibilities
- organizational personnel with mission and business responsibilities
- organizational personnel with legal responsibilities
- organizational personnel with information security responsibilities
- organizational personnel with supply chain risk management responsibilities
- organizational personnel with acquisition responsibilities
Powiązane zgłoszenia
| Typ powiązania | Zgłoszenie |
|---|---|
| blocks | IR-04(10) Supply Chain Coordination |