Navigate

RA-3(1)

RA-3(1): Supply Chain Risk Assessment

(a): Assess supply chain risks associated with [systems, system components, and system services to assess supply chain risks are defined;] ; and

(b): Update the supply chain risk assessment [the frequency at which to update the supply chain risk assessment is defined;] , when there are significant changes to the relevant supply chain, or when changes to the system, environments of operation, or other conditions may necessitate a change in the supply chain.

Supplemental

Supply chain-related events include disruption, use of defective components, insertion of counterfeits, theft, malicious development practices, improper delivery practices, and insertion of malicious code. These events can have a significant impact on the confidentiality, integrity, or availability of a system and its information and, therefore, can also adversely impact organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation. The supply chain-related events may be unintentional or malicious and can occur at any point during the system life cycle. An analysis of supply chain risk can help an organization identify systems or components for which additional supply chain risk mitigations are required.

CIA Levels
Confidentiality	low
Integrity	low
Availability	low

Overlays
CMMC, DAF Baseline

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to RA-3(1).

Control	Description
PM-17	a: Establish policy and procedures to ensure that requirements for the protection of controlled unclassified information that is processed, stored or transmitted on external systems, are implemented in accordance with applicable laws, executive orders, directives, policies, regulations, and standards; and b: Review and update the policy and procedures [one of ].
PM-30	a: Develop an organization-wide strategy for managing supply chain risks associated with the development, acquisition, maintenance, and disposal of systems, system components, and system services; b: Implement the supply chain risk management strategy consistently across the organization; and c: Review and update the supply chain risk management strategy on [the frequency for reviewing and updating the supply chain risk management strategy is defined;] or as required, to address organizational changes.
RA-2	a: Categorize the system and information it processes, stores, and transmits; b: Document the security categorization results, including supporting rationale, in the security plan for the system; and c: Verify that the authorizing official or authorizing official designated representative reviews and approves the security categorization decision.
RA-9	Identify critical system components and functions by performing a criticality analysis for [systems, system components, or system services to be analyzed for criticality are defined;] at [decision points in the system development life cycle when a criticality analysis is to be performed are defined;].
SR-2	a: Develop a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal of the following systems, system components or system services: [systems, system components, or system services for which a supply chain risk management plan is developed are defined;]; b: Review and update the supply chain risk management plan [the frequency at which to review and update the supply chain risk management plan is defined;] or as required, to address threat, organizational or environmental changes; and c: Protect the supply chain risk management plan from unauthorized disclosure and modification.

Enhancements

The controls below (if any) add on to the requirements of RA-3(1).

Control	Description
No controls

Related CCIs

The CCIs below are tied to RA-3(1).

CCI	Definition
CCI-004624	Assess supply chain risks associated with organization-defined systems, system components, and system services.
CCI-004625	Defines the systems, system-components, and system services for assessing supply chain risks.
CCI-004626	Update the supply chain risk assessment on an organization-defined frequency when there are significant changes to the relevant supply chain, or when changes to the system, environments of operation, or other conditions may necessitate a change in the supply chain.
CCI-004627	Defines the frequency for updating the supply chain assessment.