Supply Chain Risk Management
NIST SP 800-53 Rev 5 Supply Chain Risk Management controls.
Policy and Procedures
Develop, document, and disseminate to [parameter]:
Supply Chain Risk Management Plan
Develop a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal of the following systems, system components or system services: [parameter];
Supply Chain Controls and Processes
Establish a process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes of [parameter] in coordination with [parameter];
Provenance
Document, monitor, and maintain valid provenance of the following systems, system components, and associated data: [parameter].
Acquisition Strategies, Tools, and Methods
Employ the following acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks: [parameter].
Supplier Assessments and Reviews
Assess and review the supply chain-related risks associated with suppliers or contractors and the system, system component, or system service they provide [parameter].
Supply Chain Operations Security
Employ the following Operations Security (OPSEC) controls to protect supply chain-related information for the system, system component, or system service: [parameter].
Notification Agreements
Establish agreements and procedures with entities involved in the supply chain for the system, system component, or system service for the [parameter].
Tamper Resistance and Detection
Implement a tamper protection program for the system, system component, or system service.
Inspection of Systems or Components
Inspect the following systems or system components [parameter] to detect tampering: [parameter].
Component Authenticity
Develop and implement anti-counterfeit policy and procedures that include the means to detect and prevent counterfeit components from entering the system; and
Component Disposal
Dispose of [parameter] using the following techniques and methods: [parameter].