Security requirement
- a.Develop a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations, maintenance, and disposal of the system, system components, or system services.
- b.Review and update the supply chain risk management plan [Organization-defined: frequency].
- c.Protect the supply chain risk management plan from unauthorized disclosure.
Discussion
Dependence on the products, systems, and services of external providers and the nature of the relationships with those providers present an increasing level of risk to an organization. Threat actions that may increase security risks include unauthorized production, the insertion or use of counterfeits, tampering, poor manufacturing and development practices in the supply chain, theft, and the insertion of malicious software, firmware, and hardware. Supply chain risks can be endemic or systemic within a system, component, or service. Managing supply chain risks is a complex, multifaceted undertaking that requires a coordinated effort across an organization to build trust relationships and communicate with internal and external stakeholders. Supply chain risk management (SCRM) activities include identifying and assessing risks, determining appropriate risk response actions, developing SCRM plans to document response actions, and monitoring performance against the plans. The system-level SCRM plan is implementation-specific and provides constraints, policy implementation, requirements, and implications. It can either be stand-alone or incorporated into system security plans. The SCRM plan addresses the management, implementation, and monitoring of SCRM requirements and the development or sustainment of systems across the system development life cycle to support mission and business functions. Because supply chains can differ significantly across and within organizations, SCRM plans are tailored to individual program, organizational, and operational contexts.
Tailoring decisions required
Resolve these values through the governing organization’s approved tailoring and risk-management process before declaring the requirement implemented.
Implementation perspective
Treat Supply Chain Risk Management Plan as a CUI protection outcome that must be reflected in the system boundary, documented implementation, operational behavior, and assessment evidence. Pay particular attention to supply-chain governance, provenance, supplier risk, component authenticity, and dependency resilience.
- Confirm the requirement is in scope for the CUI system components, services, users, and external connections being assessed.
- Resolve every organization-defined parameter through an approved governance and tailoring process.
- Map each clause of the requirement to an accountable owner, implementation mechanism, and evidence source.
- Verify that inherited and shared implementations are supported by current provider evidence and responsibility boundaries.
- Collect evidence during normal operation and review changes, exceptions, and deficiencies on a risk-based cadence.
Questions to ask
- Which CUI assets, data flows, users, and services are protected by this requirement?
- Which portions are implemented locally, inherited, shared, or not applicable, and what evidence supports that determination?
- Do the system security plan, deployed configuration, operating process, and assessment evidence tell the same story?
- What change, incident, or threshold should trigger reassessment?
Evidence and validation
- supplier inventories and criticality ratings
- contract security clauses
- provenance and authenticity records
- supplier monitoring and incident records
Common failure patterns
- sub-tier dependencies ignored
- contracts lacking evidence and notification obligations
- open-source and service dependencies omitted
- supplier risk reviewed only during procurement
Assessment objectives and methods
Assessment objectives (13)
- a.
a plan for managing supply chain risks is developed.
- a.
the SCRM plan addresses risks associated with the research and development of the system, system components, or system services.
- a.
the SCRM plan addresses risks associated with the design of the system, system components, or system services.
- a.
the SCRM plan addresses risks associated with the manufacturing of the system, system components, or system services.
- a.
the SCRM plan addresses risks associated with the acquisition of the system, system components, or system services.
- a.
the SCRM plan addresses risks associated with the delivery of the system, system components, or system services.
- a.
the SCRM plan addresses risks associated with the integration of the system, system components, or system services.
- a.
the SCRM plan addresses risks associated with the operation of the system, system components, or system services.
- a.
the SCRM plan addresses risks associated with the maintenance of the system, system components, or system services.
- a.
the SCRM plan addresses risks associated with the disposal of the system, system components, or system services.
- b.
the SCRM plan is reviewed [Organization-defined: frequency].
- b.
the SCRM plan is updated [Organization-defined: frequency].
- c.
the SCRM plan is protected from unauthorized disclosure.
Examine
- SCRM policy and procedures
- SCRM plan
- system and services acquisition policy and procedures
- system and services acquisition procedures
- procedures for supply chain protection
- procedures for protecting the SCRM plan from unauthorized disclosure
- system development life cycle procedures
- procedures for the integration of information security requirements into the acquisition process
- acquisition documentation
- service-level agreements
- acquisition contracts for the system, system components, or system services
- list of supply chain threats
- list of safeguards for supply chain threats
- system life cycle documentation, including research and development, design, manufacturing, acquisition, delivery, integration, operations, maintenance, and disposal
- inter-organizational agreements and procedures
- system security plan
- other relevant documents or records
Interview
- personnel with acquisition responsibilities
- personnel with SCRM responsibilities
- personnel with information security responsibilities
Test
- organizational processes for defining and documenting the system development life cycle (SDLC)
- organizational processes for identifying SDLC roles and responsibilities
- organizational processes for integrating SCRM into the SDLC
- mechanisms for supporting or implementing the SDLC
Source NIST SP 800-53 controls
These controls are referenced by the official SP 800-171 Rev. 3 OSCAL record. Open the corresponding control pages for complete control text, enhancements, D3FEND mappings, and related learning.
Authoritative sources
- NIST SP 800-171 Revision 3 official publication ↗
- NIST SP 800-171A Revision 3 official publication ↗
- NIST OSCAL Content release used for this import ↗
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. The official publications, the responsible federal agency, and the governing contract or agreement determine applicability, tailoring, assessment depth, and required implementation.