SR – Supply Chain Risk Management

NIST SP 800-53B – SR – Supply Chain Risk Management

1.Kravtext (engelskt original)#

SR-1 – Policy and Procedures#

a. Develop, document, and disseminate to [organization-defined personnel or roles]:
- 1. [organization-level or mission/business process-level or system-level] supply chain risk management policy that:
  - (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
  - (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
- 1. Procedures to facilitate the implementation of the supply chain risk management policy and the associated supply chain risk management controls;
b. Designate an [organization-defined official] to manage the development, documentation, and dissemination of the supply chain risk management policy and procedures; and
c. Review and update the current supply chain risk management:
- 1. Policy [organization-defined frequency] and following [organization-defined events] ; and
- 1. Procedures [organization-defined frequency] and following [organization-defined events].

SR-2 – Supply Chain Risk Management Plan#

a. Develop a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal of the following systems, system components or system services: [organization-defined systems, system components, or system services];
b. Review and update the supply chain risk management plan [organization-defined frequency] or as required, to address threat, organizational or environmental changes; and
c. Protect the supply chain risk management plan from unauthorized disclosure and modification.

SR-2(1) – Establish SCRM Team

Establish a supply chain risk management team consisting of [organization-defined personnel, roles and responsibilities] to lead and support the following SCRM activities: [organization-defined supply chain risk management activities].

SR-3 – Supply Chain Controls and Processes#

a. Establish a process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes of [organization-defined system or system component] in coordination with [organization-defined supply chain personnel];
b. Employ the following controls to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events: [organization-defined supply chain controls] ; and
c. Document the selected and implemented supply chain processes and controls in [security and privacy plans or supply chain risk management plan or [organization-defined document] ].

SR-5 – Acquisition Strategies, Tools, and Methods#

Employ the following acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks: [organization-defined strategies, tools, and methods].

SR-6 – Supplier Assessments and Reviews#

Assess and review the supply chain-related risks associated with suppliers or contractors and the system, system component, or system service they provide [organization-defined frequency].

SR-8 – Notification Agreements#

Establish agreements and procedures with entities involved in the supply chain for the system, system component, or system service for the [notification of supply chain compromises or [organization-defined results of assessments or audits] ].

SR-10 – Inspection of Systems or Components#

Inspect the following systems or system components [at random or at [organization-defined frequency] or upon [organization-defined indications of need for inspection] ] to detect tampering: [organization-defined systems or system components].

SR-11 – Component Authenticity#

a. Develop and implement anti-counterfeit policy and procedures that include the means to detect and prevent counterfeit components from entering the system; and
b. Report counterfeit system components to [source of counterfeit component or [organization-defined external reporting organizations] or [organization-defined personnel or roles] ].

SR-11(1) – Anti-counterfeit Training

Train [organization-defined personnel or roles] to detect counterfeit system components (including hardware, software, and firmware).

SR-11(2) – Configuration Control for Component Service and Repair

Maintain configuration control over the following system components awaiting service or repair and serviced or repaired components awaiting return to service: [organization-defined system components].

SR-12 – Component Disposal#

Dispose of [organization-defined data, documentation, tools, or system components] using the following techniques and methods: [organization-defined techniques and methods].

National Institute of Standards and Technology, OSCAL release 5.2.0. Republished courtesy of the National Institute of Standards and Technology. CC0 1.0. Source.