Catalog: Electronic (OSCAL) Version of NIST SP 800-53 Rev 5.2.0 Controls and SP 800-53A Rev 5.2.0 Assessment Procedures | Controls: 44
| Control ID | Title / Statement | Priority | Baseline Impact | ||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| SR-01 |
Policy and Procedures
9 params
a. Develop, document, and disseminate to {{ insert: param, sr-1_prm_1 }}:
1. {{ insert: param, sr-01_odp.03 }} supply chain risk management policy that:
(a) Addresses purpose, scope, ro...
► View parameters
|
— | — | ||||||||||||||||||||||||||||||
| SR-02 |
Supply Chain Risk Management Plan
2 params
a. Develop a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal...
► View parameters
|
— | — | ||||||||||||||||||||||||||||||
| SR-02(01) |
Establish SCRM Team
2 params
Establish a supply chain risk management team consisting of {{ insert: param, sr-02.01_odp.01 }} to lead and support the following SCRM activities: {{ insert: param, sr-02.01_odp.02 }}.
► View parameters
|
— | — | ||||||||||||||||||||||||||||||
| SR-03 |
Supply Chain Controls and Processes
5 params
a. Establish a process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes of {{ insert: param, sr-03_odp.01 }} in coordination with {{ inse...
► View parameters
|
— | — | ||||||||||||||||||||||||||||||
| SR-03(01) |
Diverse Supply Base
3 params
Employ a diverse set of sources for the following system components and services: {{ insert: param, sr-3.1_prm_1 }}.
► View parameters
|
— | — | ||||||||||||||||||||||||||||||
| SR-03(02) |
Limitation of Harm
1 param
Employ the following controls to limit harm from potential adversaries identifying and targeting the organizational supply chain: {{ insert: param, sr-03.02_odp }}.
► View parameters
|
— | — | ||||||||||||||||||||||||||||||
| SR-03(03) |
Sub-tier Flow Down
Ensure that the controls included in the contracts of prime contractors are also included in the contracts of subcontractors.
|
— | — | ||||||||||||||||||||||||||||||
| SR-04 |
Provenance
1 param
Document, monitor, and maintain valid provenance of the following systems, system components, and associated data: {{ insert: param, sr-04_odp }}.
► View parameters
|
— | — | ||||||||||||||||||||||||||||||
| SR-04(01) |
Identity
1 param
Establish and maintain unique identification of the following supply chain elements, processes, and personnel associated with the identified system and critical system components: {{ insert: param,...
► View parameters
|
— | — | ||||||||||||||||||||||||||||||
| SR-04(02) |
Track and Trace
1 param
Establish and maintain unique identification of the following systems and critical system components for tracking through the supply chain: {{ insert: param, sr-04.02_odp }}.
► View parameters
|
— | — | ||||||||||||||||||||||||||||||
| SR-04(03) |
Validate as Genuine and Not Altered
3 params
Employ the following controls to validate that the system or system component received is genuine and has not been altered: {{ insert: param, sr-4.3_prm_1 }}.
► View parameters
|
— | — | ||||||||||||||||||||||||||||||
| SR-04(04) |
Supply Chain Integrity — Pedigree
2 params
Employ {{ insert: param, sr-04.04_odp.01 }} and conduct {{ insert: param, sr-04.04_odp.02 }} to ensure the integrity of the system and system components by validating the internal composition and p...
► View parameters
|
— | — | ||||||||||||||||||||||||||||||
| SR-05 |
Acquisition Strategies, Tools, and Methods
1 param
Employ the following acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks: {{ insert: param, sr-05_odp }}.
► View parameters
|
— | — | ||||||||||||||||||||||||||||||
| SR-05(01) |
Adequate Supply
2 params
Employ the following controls to ensure an adequate supply of {{ insert: param, sr-05.01_odp.02 }}: {{ insert: param, sr-05.01_odp.01 }}.
► View parameters
|
— | — | ||||||||||||||||||||||||||||||
| SR-05(02) |
Assessments Prior to Selection, Acceptance, Modification, or Update
Assess the system, system component, or system service prior to selection, acceptance, modification, or update.
|
— | — | ||||||||||||||||||||||||||||||
| SR-06 |
Supplier Assessments and Reviews
1 param
Assess and review the supply chain-related risks associated with suppliers or contractors and the system, system component, or system service they provide {{ insert: param, sr-06_odp }}.
► View parameters
|
— | — | ||||||||||||||||||||||||||||||
| SR-06(01) |
Testing and Analysis
2 params
Employ {{ insert: param, sr-06.01_odp.01 }} of the following supply chain elements, processes, and actors associated with the system, system component, or system service: {{ insert: param, sr-06.01...
► View parameters
|
— | — | ||||||||||||||||||||||||||||||
| SR-07 |
Supply Chain Operations Security
1 param
Employ the following Operations Security (OPSEC) controls to protect supply chain-related information for the system, system component, or system service: {{ insert: param, sr-07_odp }}.
► View parameters
|
— | — | ||||||||||||||||||||||||||||||
| SR-08 |
Notification Agreements
2 params
Establish agreements and procedures with entities involved in the supply chain for the system, system component, or system service for the {{ insert: param, sr-08_odp.01 }}.
► View parameters
|
— | — | ||||||||||||||||||||||||||||||
| SR-09 |
Tamper Resistance and Detection
Implement a tamper protection program for the system, system component, or system service.
|
— | — | ||||||||||||||||||||||||||||||
| SR-09(01) |
Multiple Stages of System Development Life Cycle
Employ anti-tamper technologies, tools, and techniques throughout the system development life cycle.
|
— | — | ||||||||||||||||||||||||||||||
| SR-10 |
Inspection of Systems or Components
4 params
Inspect the following systems or system components {{ insert: param, sr-10_odp.02 }} to detect tampering: {{ insert: param, sr-10_odp.01 }}.
► View parameters
|
— | — | ||||||||||||||||||||||||||||||
| SR-11 |
Component Authenticity
3 params
a. Develop and implement anti-counterfeit policy and procedures that include the means to detect and prevent counterfeit components from entering the system; and
b. Report counterfeit system co...
► View parameters
|
— | — | ||||||||||||||||||||||||||||||
| SR-11(01) |
Anti-counterfeit Training
1 param
Train {{ insert: param, sr-11.01_odp }} to detect counterfeit system components (including hardware, software, and firmware).
► View parameters
|
— | — | ||||||||||||||||||||||||||||||
| SR-11(02) |
Configuration Control for Component Service and Repair
1 param
Maintain configuration control over the following system components awaiting service or repair and serviced or repaired components awaiting return to service: {{ insert: param, sr-11.02_odp }}.
► View parameters
|
— | — | ||||||||||||||||||||||||||||||
| SR-11(03) |
Anti-counterfeit Scanning
1 param
Scan for counterfeit system components {{ insert: param, sr-11.03_odp }}.
► View parameters
|
— | — | ||||||||||||||||||||||||||||||
| └ sr-11a | Develop and implement anti-counterfeit policy and procedures that include the means to detect and prevent counterfeit components from entering the ... | — | — | ||||||||||||||||||||||||||||||
| └ sr-11b | Report counterfeit system components to {{ insert: param, sr-11_odp.01 }}. | — | — | ||||||||||||||||||||||||||||||
| SR-12 |
Component Disposal
2 params
Dispose of {{ insert: param, sr-12_odp.01 }} using the following techniques and methods: {{ insert: param, sr-12_odp.02 }}.
► View parameters
|
— | — | ||||||||||||||||||||||||||||||
| └ sr-1a | Develop, document, and disseminate to {{ insert: param, sr-1_prm_1 }}: | — | — | ||||||||||||||||||||||||||||||
| └ sr-1a.1 | {{ insert: param, sr-01_odp.03 }} supply chain risk management policy that: | — | — | ||||||||||||||||||||||||||||||
| └ sr-1a.1.(a) | Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and | — | — | ||||||||||||||||||||||||||||||
| └ sr-1a.1.(b) | Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and | — | — | ||||||||||||||||||||||||||||||
| └ sr-1a.2 | Procedures to facilitate the implementation of the supply chain risk management policy and the associated supply chain risk management controls; | — | — | ||||||||||||||||||||||||||||||
| └ sr-1b | Designate an {{ insert: param, sr-01_odp.04 }} to manage the development, documentation, and dissemination of the supply chain risk management poli... | — | — | ||||||||||||||||||||||||||||||
| └ sr-1c | Review and update the current supply chain risk management: | — | — | ||||||||||||||||||||||||||||||
| └ sr-1c.1 | Policy {{ insert: param, sr-01_odp.05 }} and following {{ insert: param, sr-01_odp.06 }} ; and | — | — | ||||||||||||||||||||||||||||||
| └ sr-1c.2 | Procedures {{ insert: param, sr-01_odp.07 }} and following {{ insert: param, sr-01_odp.08 }}. | — | — | ||||||||||||||||||||||||||||||
| └ sr-2a | Develop a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integrat... | — | — | ||||||||||||||||||||||||||||||
| └ sr-2b | Review and update the supply chain risk management plan {{ insert: param, sr-02_odp.02 }} or as required, to address threat, organizational or envi... | — | — | ||||||||||||||||||||||||||||||
| └ sr-2c | Protect the supply chain risk management plan from unauthorized disclosure and modification. | — | — | ||||||||||||||||||||||||||||||
| └ sr-3a | Establish a process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes of {{ insert: param,... | — | — | ||||||||||||||||||||||||||||||
| └ sr-3b | Employ the following controls to protect against supply chain risks to the system, system component, or system service and to limit the harm or con... | — | — | ||||||||||||||||||||||||||||||
| └ sr-3c | Document the selected and implemented supply chain processes and controls in {{ insert: param, sr-03_odp.04 }}. | — | — |