SR-8 Notification agreements
Requires agreements and procedures to be established with entities in the supply chain for notification of supply chain compromises, and of any other organization-defined events such as vulnerabilities or component chang
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Records of notifications received and how they were handled · Document repository
governing documentDocuments that govern the control
- Contract clauses or agreements requiring notification of supply chain compromise · Vendor register / contract repository
- Documented notification procedures including recipients and expected timeframes · Policy repository / GRC workspace
- Register of supply chain entities covered by such agreements · Vendor register / contract repository
First move
Common gaps auditors find
- Notification obligations absent from agreements with smaller or indirect suppliers
- No internal procedure for handling a notification when it arrives
- Notification expected but no timeframe agreed, so disclosure can be indefinitely delayed
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSR-7 Supply Chain Operations Security. Employ the following Operations Security (OPSEC) controls to protect supply chain-related information for the system, system component, or system service: [organization-defined] · SR-9 Tamper Resistance and Detection. Implement a tamper protection program for the system, system component, or system service