PM-30 Supply Chain Risk Management Strategy. Develop an organization-wide strategy for managing supply chain risks associated with the development, acquisition, maintenance, and disposal of systems, system components, and system services; Implement the supply chain risk
Supply Chain Risk Management Strategy. Develop an organization-wide strategy for managing supply chain risks associated with the development, acquisition, maintenance, and disposal of systems, system components, and syst.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence of implementation across the organisation, not only within one programme · Document repository
- Review and update records for the strategy against the defined frequency and on significant supply chain change · Document repository
governing documentDocuments that govern the control
- The organisation-wide supply chain risk management strategy covering development, acquisition, maintenance and disposal · Policy repository / GRC workspace
- Linkage from the strategy to the supply chain controls applied in acquisitions · Document repository
- Identification of the roles accountable for supply chain risk under the strategy · Policy repository / GRC workspace
First move
Common gaps auditors find
- Strategy covers acquisition while maintenance and disposal, where components leave organisational control, are unaddressed
- Written centrally and never implemented in the procurement process that actually selects suppliers
- No review trigger tied to supply chain events, so a major supplier compromise does not prompt reassessment
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetPM-29 Risk Management Program Leadership Roles. Appoint a Senior Accountable Official for Risk Management to align organizational information security and privacy management processes with strategic, operational, and budgetary planning processes; and Establish a Risk Executive · PM-31 Continuous Monitoring Strategy. Develop an organization-wide continuous monitoring strategy and implement continuous monitoring programs that include: Establishing the following organization-wide metrics to be monitored: [organization-defined]; Establishing [organization-defined] and [organization-defined] for control effectiveness; Ongoing monitoring