CCI-004624

Assess supply chain risks associated with organization-defined systems, system components, and system services.

Implementation Guidance

Determine if supply chain risks associated with [RA-03(01)_ODP[01]; systems, system components, and system services to assess supply chain risks are defined] are assessed.

Validation Procedures

Examine: [SELECT FROM: Supply chain risk management policy; inventory of critical systems, system components, and system services; risk assessment policy; security planning policy and procedures; procedures addressing organizational assessments of supply chain risk; risk assessment; risk assessment results; risk assessment reviews; risk assessment updates; acquisition policy; system security plan; supply chain risk management plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with risk assessment responsibilities; organizational personnel with security responsibilities; organizational personnel with supply chain risk management responsibilities]. Test: [SELECT FROM: Organizational processes for risk assessment; mechanisms supporting and/or conducting, documenting, reviewing, disseminating, and updating the supply chain risk assessment].

The controls below (if any) were marked by NIST as being related to CCI-004624.