Navigate

PM-30(1)

PM-30(1): Suppliers of Critical or Mission-essential Items

Identify, prioritize, and assess suppliers of critical or mission-essential technologies, products, and services.

Supplemental

The identification and prioritization of suppliers of critical or mission-essential technologies, products, and services is paramount to the mission/business success of organizations. The assessment of suppliers is conducted using supplier reviews (see [SR-6](#sr-6) ) and supply chain risk assessment processes (see [RA-3(1)](#ra-3.1) ). An analysis of supply chain risk can help an organization identify systems or components for which additional supply chain risk mitigations are required.

CIA Levels
Confidentiality	low
Integrity	low
Availability	low

Overlays
DAF Baseline

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to PM-30(1).

Control	Description
RA-3	a: Conduct a risk assessment, including: 1: Identifying threats to and vulnerabilities in the system; 2: Determining the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system, the information it processes, stores, or transmits, and any related information; and 3: Determining the likelihood and impact of adverse effects on individuals arising from the processing of personally identifiable information; b: Integrate risk assessment results and risk management decisions from the organization and mission or business process perspectives with system-level risk assessments; c: Document risk assessment results in [one of "security and privacy plans"/"risk assessment report"/"{{ insert: param, ra-03_odp.02 }} "]; d: Review risk assessment results [the frequency to review risk assessment results is defined;]; e: Disseminate risk assessment results to [personnel or roles to whom risk assessment results are to be disseminated is/are defined;] ; and f: Update the risk assessment [the frequency to update the risk assessment is defined;] or when there are significant changes to the system, its environment of operation, or other conditions that may impact the security or privacy state of the system.
SR-6	Assess and review the supply chain-related risks associated with suppliers or contractors and the system, system component, or system service they provide [the frequency at which to assess and review the supply chain-related risks associated with suppliers or contractors and the systems, system components, or system services they provide is defined;].

Control

Description

RA-3

a: Conduct a risk assessment, including:
- 1: Identifying threats to and vulnerabilities in the system;
- 2: Determining the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system, the information it processes, stores, or transmits, and any related information; and
- 3: Determining the likelihood and impact of adverse effects on individuals arising from the processing of personally identifiable information;

b: Integrate risk assessment results and risk management decisions from the organization and mission or business process perspectives with system-level risk assessments;

c: Document risk assessment results in [one of "security and privacy plans"/"risk assessment report"/"{{ insert: param, ra-03_odp.02 }} "];

d: Review risk assessment results [the frequency to review risk assessment results is defined;];

e: Disseminate risk assessment results to [personnel or roles to whom risk assessment results are to be disseminated is/are defined;] ; and

f: Update the risk assessment [the frequency to update the risk assessment is defined;] or when there are significant changes to the system, its environment of operation, or other conditions that may impact the security or privacy state of the system.

SR-6

Assess and review the supply chain-related risks associated with suppliers or contractors and the system, system component, or system service they provide [the frequency at which to assess and review the supply chain-related risks associated with suppliers or contractors and the systems, system components, or system services they provide is defined;].

Enhancements

The controls below (if any) add on to the requirements of PM-30(1).

Control	Description
No controls

Related CCIs

The CCIs below are tied to PM-30(1).

CCI	Definition
CCI-005150	Identify, prioritize, and assess suppliers of critical or mission-essential technologies, products, and services.