BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

SR-02(01) Establish SCRM Team

NIST SP 800-53 (controls) 5.2.0 against 5.2.0
All changes in this version
unchanged SR Low baselineModerate baselineHigh baseline part of SR-2

Title

Establish SCRM Team

Control

Establish a supply chain risk management team consisting of [Assignment: personnel, roles and responsibilities] to lead and support the following SCRM activities: [Assignment: supply chain risk management activities].

Discussion

To implement supply chain risk management plans, organizations establish a coordinated, team-based approach to identify and assess supply chain risks and manage these risks by using programmatic and technical mitigation techniques. The team approach enables organizations to conduct an analysis of their supply chain, communicate with internal and external partners or stakeholders, and gain broad consensus regarding the appropriate resources for SCRM. The SCRM team consists of organizational personnel with diverse roles and responsibilities for leading and supporting SCRM activities, including risk executive, information technology, contracting, information security, privacy, mission or business, legal, supply chain and logistics, acquisition, business continuity, and other relevant functions. Members of the SCRM team are involved in various aspects of the SDLC and, collectively, have an awareness of and provide expertise in acquisition processes, legal practices, vulnerabilities, threats, and attack vectors, as well as an understanding of the technical aspects and dependencies of systems. The SCRM team can be an extension of the security and privacy risk management processes or be included as part of an organizational risk management team.

Parameters

sr-02.01_odp.01: personnel, roles and responsibilities
sr-02.01_odp.02: supply chain risk management activities

Assessment objective

SR-02(01) a supply chain risk management team consisting of [Assignment: personnel, roles and responsibilities] is established to lead and support [Assignment: supply chain risk management activities].

STIG rules that implement this control 0

No followed STIG rule cites a CCI indexed to this control (CCI list 2026-07-14).