Assessment Objective

Determine if:

• SR-03(01)[01] a diverse set of sources is employed for [Assignment: system components];
• SR-03(01)[02] a diverse set of sources is employed for [Assignment: services].

Assessment Methods

Examine

• Supply chain risk management policy and procedures
• system and services acquisition policy
• planning policy
• procedures addressing supply chain protection
• physical inventory of critical systems and system components
• inventory of critical suppliers, service providers, developers, and contracts
• inventory records of critical system components
• list of security safeguards ensuring an adequate supply of critical system components
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with system and services acquisition responsibilities
• organizational personnel with information security responsibilities
• organizational personnel with supply chain protection responsibilities

Test

• Organizational processes for defining and employing security safeguards to ensure an adequate supply of critical system components
• processes to identify critical suppliers
• mechanisms supporting and/or implementing the security safeguards that ensure an adequate supply of critical system components

Prepojené úlohy

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final