NIST SP 800-161 Rev 1 (supply chain): the evidence behind every control

191 controls. For each, the artefacts auditors ask for, which ones a system already holds, and the first move to stop evidencing it by periodic review.

C-SCRM Family: Access Control

AC-1Policy and Procedures hard AC-2Account Management hard AC-3Access Enforcement moderate AC-4Information Flow Enforcement hard AC-5Separation of Duties hard AC-6Least Privilege hard AC-17Remote Access moderate AC-18Wireless Access hard AC-19Access Control for Mobile Devices hard AC-20Use of External Systems hard AC-21Information Sharing hard AC-22Publicly Accessible Content hard AC-23Data Mining Protection moderate AC-24Access Control Decisions hard

C-SCRM Family: Awareness and Training

AT-1Policy and Procedures hard AT-2Literacy Training and Awareness hard AT-3Role-Based Training hard AT-4Training Records hard

C-SCRM Family: Audit and Accountability

AU-1Policy and Procedures moderate AU-2Event Logging moderate AU-3Content of Audit Records easy AU-6Audit Review, Analysis, and Reporting hard AU-10Non-repudiation hard AU-12Audit Record Generation easy AU-13Monitoring for Information Disclosure hard AU-14Session Audit hard AU-16Cross-Organizational Audit Logging moderate

C-SCRM Family: Assessment, Authorization, and Monitoring

CA-1Policy and Procedures hard CA-2Control Assessments hard CA-3Information Exchange hard CA-5Plan of Action and Milestones hard CA-6Authorization hard CA-7Continuous Monitoring easy

C-SCRM Family: Configuration Management

CM-1Policy and Procedures hard CM-2Baseline Configuration hard CM-3Configuration Change Control hard CM-4Impact Analysis hard CM-5Access Restrictions for Change moderate CM-6Configuration Settings hard CM-7Least Functionality hard CM-8System Component Inventory hard CM-9Configuration Management Plan hard CM-10Software Usage Restrictions hard CM-11User-Installed Software moderate CM-12Information Location hard CM-13Data Action Mapping hard CM-14Signed Components hard

C-SCRM Family: Contingency Planning

CP-1Policy and Procedures hard CP-2Contingency Plan hard CP-3Contingency Training hard CP-4Contingency Plan Testing hard CP-6Alternative Storage Site hard CP-7Alternative Processing Site hard CP-8Telecommunications Services hard CP-11Alternative Communications Protocols hard

C-SCRM Family: Identification and Authentication

IA-1Policy and Procedures hard IA-2Identification and Authentication (Organizational Users) moderate IA-3Device Identification and Authentication moderate IA-4Identifier Management hard IA-5Authenticator Management hard IA-8Identification and Authentication (Non-Organizational Users) hard IA-9Service Identification and Authentication hard

C-SCRM Family: Incident Response

IR-1Policy and Procedures hard IR-2Incident Response Training hard IR-3Incident Response Testing hard IR-4Incident Handling hard IR-5Incident Monitoring hard IR-6Incident Reporting hard IR-7Incident Response Assistance hard IR-8Incident Response Plan hard IR-9Information Spillage Response hard

C-SCRM Family: Maintenance

MA-1Policy and Procedures hard MA-2Controlled Maintenance hard MA-3Maintenance Tools hard MA-4Nonlocal Maintenance moderate MA-5Maintenance Personnel hard MA-6Timely Maintenance hard MA-7Field Maintenance hard MA-8Maintenance Monitoring and Information Sharing moderate

C-SCRM Family: Media Protection

MP-1Policy and Procedures hard MP-4Media Storage hard MP-5Media Transport hard MP-6Media Sanitization hard

C-SCRM Family: Physical and Environmental Protection

PE-1Policy and Procedures hard PE-2Physical Access Authorizations hard PE-3Physical Access Control hard PE-6Monitoring Physical Access moderate PE-16Delivery and Removal hard PE-17Alternative Work Site hard PE-18Location of System Components hard PE-20Asset Monitoring and Tracking moderate PE-23Facility Location hard

C-SCRM Family: Planning

PL-1Policy and Procedures hard PL-2System Security and Privacy Plans hard PL-4Rules of Behavior hard PL-7Concept of Operations hard PL-8Security and Privacy Architectures hard PL-9Central Management hard PL-10Baseline Selection hard

C-SCRM Family: Program Management

PM-2Information Security Program Leadership Role hard PM-3Information Security and Privacy Resources hard PM-4Plan of Action and Milestones Process hard PM-5System Inventory hard PM-6Measures of Performance hard PM-7Enterprise Architecture hard PM-8Critical Infrastructure Plan hard PM-9Risk Management Strategy hard PM-10Authorization Process hard PM-11Mission and Business Process Definition hard PM-12Insider Threat Program hard PM-13Security and Privacy Workforce hard PM-14Testing, Training, and Monitoring moderate PM-15Security and Privacy Groups and Associations hard PM-16Threat Awareness Program hard PM-17Protecting Controlled Unclassified Information on External Systems hard PM-18Privacy Program Plan hard PM-19Privacy Program Leadership Role hard PM-20Dissemination of Privacy Program Information hard PM-21Accounting of Disclosures hard PM-22Personally Identifiable Information Quality Management hard PM-23Data Governance Body hard PM-25Minimization of Personally Identifiable Information Used in Testing, Training, and Research hard PM-26Complaint Management hard PM-27Privacy Reporting hard PM-28Risk Framing hard PM-29Risk Management Program Leadership Roles hard PM-30Supply Chain Risk Management Strategy hard PM-31Continuous Monitoring Strategy easy PM-32Purposing hard

C-SCRM Family: Personnel Security

PS-1Policy and Procedures hard PS-3Personnel Screening hard PS-6Access Agreements moderate PS-7External Personnel Security hard

C-SCRM Family: Personally Identifiable Information Processing and Transparency

PT-1Policy and Procedures hard

C-SCRM Family: Risk Assessment

RA-1Policy and Procedures hard RA-2Security Categorization hard RA-3Risk Assessment hard RA-5Vulnerability Monitoring and Scanning hard RA-7Risk Response hard RA-9Criticality Analysis hard RA-10Threat Hunting hard

C-SCRM Family: System and Services Acquisition

SA-1Policy and Procedures hard SA-2Allocation of Resources hard SA-3System Development Life Cycle hard SA-4Acquisition Process hard SA-5System Documentation hard SA-8Security and Privacy Engineering Principles hard SA-9External System Services hard SA-10Developer Configuration Management easy SA-11Developer Testing and Evaluation hard SA-15Development Process, Standards, and Tools hard SA-16Developer-Provided Training hard SA-17Developer Security and Privacy Architecture and Design hard SA-20Customized Development of Critical Components hard SA-21Developer Screening hard SA-22Unsupported System Components hard

C-SCRM Family: System and Communications Protection

SC-1Policy and Procedures hard SC-4Information in Shared Resources hard SC-5Denial-of-Service Protection hard SC-7Boundary Protection easy SC-8Transmission Confidentiality and Integrity moderate SC-18Mobile Code moderate SC-27Platform-Independent Applications hard SC-28Protection of Information at Rest hard SC-29Heterogeneity hard SC-30Concealment and Misdirection hard SC-36Distributed Processing and Storage hard SC-37Out-of-Band Channels hard SC-38Operations Security hard SC-47Alternative Communications Paths hard

C-SCRM Family: System and Information Integrity

SI-1Policy and Procedures hard SI-2Flaw Remediation hard SI-3Malicious Code Protection hard SI-4System Monitoring easy SI-5Security Alerts, Advisories, and Directives hard SI-7Software, Firmware, and Information Integrity hard SI-12Information Management and Retention hard SI-20Tainting hard

C-SCRM Family: Supply Chain Risk Management

SR-1Policy and Procedures hard SR-2Supply Chain Risk Management Plan hard SR-3Supply Chain Controls and Processes hard SR-4Provenance hard SR-5Acquisition Strategies, Tools, and Methods hard SR-6Supplier Assessments and Reviews hard SR-7Supply Chain Operations Security hard SR-8Notification Agreements hard SR-9Tamper Resistance and Detection hard SR-10Inspection of Systems or Components hard SR-11Component Authenticity hard SR-12Component Disposal hard SR-13Supplier Inventory hard