💼 GV.SC-09: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle

Description

Policies and procedures require provenance records for all acquired technology products and services
Periodically provide risk reporting to leaders about how acquired components are proven to be untampered and authentic
Communicate regularly among cybersecurity risk managers and operations personnel about the need to acquire software patches, updates, and upgrades only from authenticated and trustworthy software providers
Review policies to ensure that they require approved supplier personnel to perform maintenance on supplier products
Policies and procedure require checking upgrades to critical hardware for unauthorized changes

Section	Sub Sections	Internal Rules	Policies	Compliance
💼 NIST CSF v1.1 → 💼 ID.SC-1: Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders				no data
💼 NIST SP 800-53 Revision 5 → 💼 PM-9 Risk Management Strategy				no data
💼 NIST SP 800-53 Revision 5 → 💼 PM-19 Privacy Program Leadership Role				no data
💼 NIST SP 800-53 Revision 5 → 💼 PM-28 Risk Framing				no data
💼 NIST SP 800-53 Revision 5 → 💼 PM-30 Supply Chain Risk Management Strategy	1			no data
💼 NIST SP 800-53 Revision 5 → 💼 PM-31 Continuous Monitoring Strategy				no data
💼 NIST SP 800-53 Revision 5 → 💼 RA-3 Risk Assessment	4		1	no data
💼 NIST SP 800-53 Revision 5 → 💼 RA-7 Risk Response				no data
💼 NIST SP 800-53 Revision 5 → 💼 SA-4 Acquisition Process	12			no data
💼 NIST SP 800-53 Revision 5 → 💼 SA-9 External System Services	8	1	1	no data
💼 NIST SP 800-53 Revision 5 → 💼 SR-2 Supply Chain Risk Management Plan	1			no data
💼 NIST SP 800-53 Revision 5 → 💼 SR-3 Supply Chain Controls and Processes	3			no data
💼 NIST SP 800-53 Revision 5 → 💼 SR-5 Acquisition Strategies, Tools, and Methods	2			no data
💼 NIST SP 800-53 Revision 5 → 💼 SR-6 Supplier Assessments and Reviews	1			no data

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance