Navigate

CCI-004470

CCI-004470 Definition

Implement the supply chain risk management strategy consistently across the organization.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if the supply chain risk management strategy is implemented consistently across the organization.

Validation Procedures

Examine: [SELECT FROM: Supply chain risk management strategy; organizational risk management strategy; enterprise risk management documents; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with supply chain risk management responsibilities; organizational personnel with information security responsibilities; organizational personnel with acquisition responsibilities; organizational personnel with enterprise risk management responsibilities].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-004470.

Control	Description
PM-30	a: Develop an organization-wide strategy for managing supply chain risks associated with the development, acquisition, maintenance, and disposal of systems, system components, and system services; b: Implement the supply chain risk management strategy consistently across the organization; and c: Review and update the supply chain risk management strategy on [the frequency for reviewing and updating the supply chain risk management strategy is defined;] or as required, to address organizational changes.

Control

Description

PM-30

a: Develop an organization-wide strategy for managing supply chain risks associated with the development, acquisition, maintenance, and disposal of systems, system components, and system services;

b: Implement the supply chain risk management strategy consistently across the organization; and

c: Review and update the supply chain risk management strategy on [the frequency for reviewing and updating the supply chain risk management strategy is defined;] or as required, to address organizational changes.