CCI-005116

Defines the critical system components that the organization-defined controls ensure an adequate supply of.

Implementation Guidance

Determine if [SR-05(01)_ODP[01]; controls to ensure an adequate supply of critical system components are defined] are employed to ensure an adequate supply of [SR-05(01)_ODP[02]; critical system components of which an adequate supply is required are defined].

Validation Procedures

Examine: [SELECT FROM: Supply chain risk management policy and procedures; supply chain risk management strategy; supply chain risk management plan; contingency planning documents; inventory of critical systems and system components; determination of adequate supply; system and services acquisition policy; procedures addressing supply chain protection; procedures addressing the integration of information security requirements into the acquisition process; procedures addressing the integration of acquisition strategies, contract tools, and procurement methods into the acquisition process; solicitation documentation; acquisition documentation; service level agreements; acquisition contracts for systems or services; purchase orders/requisitions for the system, system component, or system service from suppliers; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with system and services acquisition responsibilities; organizational personnel with information security responsibilities; organizational personnel with supply chain risk management responsibilities]. Test: [SELECT FROM: Organizational processes for defining and employing tailored acquisition strategies, contract tools, and procurement methods; mechanisms supporting and/or implementing the definition and employment of tailored acquisition strategies, contract tools, and procurement methods].

The controls below (if any) were marked by NIST as being related to CCI-005116.