Security requirement
Develop and implement acquisition strategies, contract tools, and procurement methods to identify, protect against, and mitigate supply chain risks.
Discussion
The acquisition process provides an important vehicle for protecting the supply chain. There are many useful tools and techniques available, including obscuring the end use of a system or system component, using blind purchases, requiring tamperevident packaging, or using trusted or controlled distribution. The results from a supply chain risk assessment can inform the strategies, tools, and methods that are most applicable to the situation. Tools and techniques may provide protections against unauthorized production, theft, tampering, the insertion of counterfeits, the insertion of malicious software or backdoors, and poor development practices throughout the system life cycle. Organizations also consider providing incentives for suppliers to implement safeguards, promote transparency in their processes and security practices, provide contract language that addresses the prohibition of tainted or counterfeit components, and restrict purchases from untrustworthy suppliers. Organizations consider providing training, education, and awareness programs for personnel regarding supply chain risks, available mitigation strategies, and when the programs should be employed. Methods for reviewing and protecting development plans, documentation, and evidence are commensurate with the security requirements of the organization. Contracts may specify documentation protection requirements.
Implementation perspective
Treat Acquisition Strategies, Tools, and Methods as a CUI protection outcome that must be reflected in the system boundary, documented implementation, operational behavior, and assessment evidence. Pay particular attention to supply-chain governance, provenance, supplier risk, component authenticity, and dependency resilience.
- Confirm the requirement is in scope for the CUI system components, services, users, and external connections being assessed.
- Resolve every organization-defined parameter through an approved governance and tailoring process.
- Map each clause of the requirement to an accountable owner, implementation mechanism, and evidence source.
- Verify that inherited and shared implementations are supported by current provider evidence and responsibility boundaries.
- Collect evidence during normal operation and review changes, exceptions, and deficiencies on a risk-based cadence.
Questions to ask
- Which CUI assets, data flows, users, and services are protected by this requirement?
- Which portions are implemented locally, inherited, shared, or not applicable, and what evidence supports that determination?
- Do the system security plan, deployed configuration, operating process, and assessment evidence tell the same story?
- What change, incident, or threshold should trigger reassessment?
Evidence and validation
- supplier inventories and criticality ratings
- contract security clauses
- provenance and authenticity records
- supplier monitoring and incident records
Common failure patterns
- sub-tier dependencies ignored
- contracts lacking evidence and notification obligations
- open-source and service dependencies omitted
- supplier risk reviewed only during procurement
Assessment objectives and methods
Assessment objectives (6)
- SR-03.17.2.
acquisition strategies, contract tools, and procurement methods are developed to identify supply chain risks.
- SR-03.17.2.
acquisition strategies, contract tools, and procurement methods are developed to protect against supply chain risks.
- SR-03.17.2.
acquisition strategies, contract tools, and procurement methods are developed to mitigate supply chain risks.
- SR-03.17.2.
acquisition strategies, contract tools, and procurement methods are implemented to identify supply chain risks.
- SR-03.17.2.
acquisition strategies, contract tools, and procurement methods are implemented to protect against supply chain risks.
- SR-03.17.2.
acquisition strategies, contract tools, and procurement methods are implemented to mitigate supply chain risks.
Examine
- SCRM policy and procedures
- SCRM plan
- system and services acquisition policy and procedures
- procedures for supply chain protection
- procedures for the integration of information security requirements into the acquisition process
- solicitation documentation
- acquisition documentation (including purchase orders)
- service-level agreements
- acquisition contracts for the system, system components, or services
- documentation of identified supply chain risks
- mitigation plans for supply chain risks
- documentation of training, education, and awareness programs for personnel regarding supply chain risk
- system security plan
- other relevant documents or records
Interview
- personnel with acquisition responsibilities
- personnel with SCRM responsibilities
- personnel with information security responsibilities
Test
- processes for defining and employing tailored acquisition strategies, contract tools, and procurement methods
- mechanisms for implementing tailored acquisition strategies, contract tools, and procurement methods
Source NIST SP 800-53 controls
These controls are referenced by the official SP 800-171 Rev. 3 OSCAL record. Open the corresponding control pages for complete control text, enhancements, D3FEND mappings, and related learning.
Authoritative sources
- NIST SP 800-171 Revision 3 official publication ↗
- NIST SP 800-171A Revision 3 official publication ↗
- NIST OSCAL Content release used for this import ↗
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. The official publications, the responsible federal agency, and the governing contract or agreement determine applicability, tailoring, assessment depth, and required implementation.