SR-3(2) Supply Chain Controls and Processes | Limitation of Harm
Employ the following controls to limit harm from potential adversaries identifying and targeting the organizational supply chain: organization-defined controls.
Source: NIST SP 800-53 Rev 5, SR-3(2). The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open NIST SP 800-53 Rev 5 in the compliance library.
Base controls and their enhancements. Which apply follows the baseline you are assessed against (for example FedRAMP Moderate or High, or the low, moderate and high baselines of SP 800-53B). Text in square brackets is a parameter your organisation sets.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Procedures addressing the baseline configuration of the system · Cloud console / configuration management
periodic reviewEvidence produced at each review
- Test of Organizational processes for defining and employing safeguards to limit harm from adversaries of the organizational supply chain; mechanisms supporting and/or implementing the definition and employment of safeguards to protect the organizational supply chain · Document repository
governing documentDocuments that govern the control
- Supply chain risk management policy and procedures · Policy repository / GRC workspace
- Supply chain risk management plan · Policy repository / GRC workspace
- System and services acquisition policy · Policy repository / GRC workspace
- Configuration management policy · Policy repository / GRC workspace
- Procedures addressing supply chain protection · Policy repository / GRC workspace
- Procedures addressing the integration of information security requirements into the acquisition process · Policy repository / GRC workspace
- Configuration management plan · Policy repository / GRC workspace
- System design documentation · Document repository
First move
Common gaps auditors find
- No controls limit harm from adversaries identifying and targeting the supply chain
- The controls for limiting supply chain targeting were never defined
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSR-3(1) Supply Chain Controls and Processes | Diverse Supply Base · SR-3(3) Supply Chain Controls and Processes | Sub-tier Flow Down