CCI-002793

Provide incident information to other organizations involved in the supply chain or supply chain governance for systems or system components related to the incident.

Implementation Guidance

The organization being inspected/assessed documents and implement a process to provide security incident information to other organizations involved in the supply chain for information systems or information system components related to the incident.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed provides security incident information to other organizations involved in the supply chain for information systems or information system components related to the incident.

Compelling Evidence

1.) Documentation of a process to provide security incident information to other organizations involved in the supply chain for information systems or information system components related to the incident.

The controls below (if any) were marked by NIST as being related to CCI-002793.