NIST SP 800-53 (controls) 5.1.1+u4
| Ref | Title | Text | |
|---|---|---|---|
| SR-01 | Policy and Procedures | a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): organization-level; mission/business process-level; system-level] supply chain risk management policy that: (a) Add | |
| SR-02 | Supply Chain Risk Management Plan | a. Develop a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal of the following systems, system components | |
| SR-02(01) in SR-2 |
Establish SCRM Team | Establish a supply chain risk management team consisting of [Assignment: personnel, roles and responsibilities] to lead and support the following SCRM activities: [Assignment: supply chain risk management activities]. | |
| SR-03 | Supply Chain Controls and Processes | a. Establish a process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes of [Assignment: system or system component] in coordination with [Assignment: supply chain personnel]; b. Empl | |
| SR-03(01) in SR-3 |
Diverse Supply Base | Employ a diverse set of sources for the following system components and services: [Assignment: organization-defined system components and services]. | |
| SR-03(02) in SR-3 |
Limitation of Harm | Employ the following controls to limit harm from potential adversaries identifying and targeting the organizational supply chain: [Assignment: controls]. | |
| SR-03(03) in SR-3 |
Sub-tier Flow Down | Ensure that the controls included in the contracts of prime contractors are also included in the contracts of subcontractors. | |
| SR-04 | Provenance | Document, monitor, and maintain valid provenance of the following systems, system components, and associated data: [Assignment: systems, system components, and associated data]. | |
| SR-04(01) in SR-4 |
Identity | Establish and maintain unique identification of the following supply chain elements, processes, and personnel associated with the identified system and critical system components: [Assignment: supply chain elements, processes, and personnel | |
| SR-04(02) in SR-4 |
Track and Trace | Establish and maintain unique identification of the following systems and critical system components for tracking through the supply chain: [Assignment: systems and critical system components]. | |
| SR-04(03) in SR-4 |
Validate as Genuine and Not Altered | Employ the following controls to validate that the system or system component received is genuine and has not been altered: [Assignment: organization-defined controls]. | |
| SR-04(04) in SR-4 |
Supply Chain Integrity — Pedigree | Employ [Assignment: controls] and conduct [Assignment: analysis method] to ensure the integrity of the system and system components by validating the internal composition and provenance of critical or mission-essential technologies, product | |
| SR-05 | Acquisition Strategies, Tools, and Methods | Employ the following acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks: [Assignment: strategies, tools, and methods]. | |
| SR-05(01) in SR-5 |
Adequate Supply | Employ the following controls to ensure an adequate supply of [Assignment: critical system components]: [Assignment: controls]. | |
| SR-05(02) in SR-5 |
Assessments Prior to Selection, Acceptance, Modification, or Update | Assess the system, system component, or system service prior to selection, acceptance, modification, or update. | |
| SR-06 | Supplier Assessments and Reviews | Assess and review the supply chain-related risks associated with suppliers or contractors and the system, system component, or system service they provide [Assignment: frequency]. | |
| SR-06(01) in SR-6 |
Testing and Analysis | Employ [Selection (one or more): organizational analysis; independent third-party analysis; organizational testing; independent third-party testing] of the following supply chain elements, processes, and actors associated with the system, s | |
| SR-07 | Supply Chain Operations Security | Employ the following Operations Security (OPSEC) controls to protect supply chain-related information for the system, system component, or system service: [Assignment: OPSEC controls]. | |
| SR-08 | Notification Agreements | Establish agreements and procedures with entities involved in the supply chain for the system, system component, or system service for the [Selection (one or more): notification of supply chain compromises; {{ insert: param, sr-08_odp.02 }} | |
| SR-09 | Tamper Resistance and Detection | Implement a tamper protection program for the system, system component, or system service. | |
| SR-09(01) in SR-9 |
Multiple Stages of System Development Life Cycle | Employ anti-tamper technologies, tools, and techniques throughout the system development life cycle. | |
| SR-10 | Inspection of Systems or Components | Inspect the following systems or system components [Selection (one or more): at random; at {{ insert: param, sr-10_odp.03 }} ; upon {{ insert: param, sr-10_odp.04 }} ] to detect tampering: [Assignment: systems or system components]. | |
| SR-11 | Component Authenticity | a. Develop and implement anti-counterfeit policy and procedures that include the means to detect and prevent counterfeit components from entering the system; and b. Report counterfeit system components to [Selection (one or more): source of | |
| SR-11(01) in SR-11 |
Anti-counterfeit Training | Train [Assignment: personnel or roles] to detect counterfeit system components (including hardware, software, and firmware). | |
| SR-11(02) in SR-11 |
Configuration Control for Component Service and Repair | Maintain configuration control over the following system components awaiting service or repair and serviced or repaired components awaiting return to service: [Assignment: system components]. | |
| SR-11(03) in SR-11 |
Anti-counterfeit Scanning | Scan for counterfeit system components [Assignment: frequency]. | |
| SR-12 | Component Disposal | Dispose of [Assignment: data, documentation, tools, or system components] using the following techniques and methods: [Assignment: techniques and methods]. |
27 of 1193.