Navigate

SR-3

SR-3: Supply Chain Controls and Processes

a: Establish a process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes of [the system or system component requiring a process or processes to identify and address weaknesses or deficiencies is defined;] in coordination with [supply chain personnel with whom to coordinate the process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes is/are defined;];

b: Employ the following controls to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events: [supply chain controls employed to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events are defined;] ; and

c: Document the selected and implemented supply chain processes and controls in [one or more of "security and privacy plans"/"supply chain risk management plan"/"{{ insert: param, sr-03_odp.05 }} "].

Supplemental

Supply chain elements include organizations, entities, or tools employed for the research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal of systems and system components. Supply chain processes include hardware, software, and firmware development processes; shipping and handling procedures; personnel security and physical security programs; configuration management tools, techniques, and measures to maintain provenance; or other programs, processes, or procedures associated with the development, acquisition, maintenance and disposal of systems and system components. Supply chain elements and processes may be provided by organizations, system integrators, or external providers. Weaknesses or deficiencies in supply chain elements or processes represent potential vulnerabilities that can be exploited by adversaries to cause harm to the organization and affect its ability to carry out its core missions or business functions. Supply chain personnel are individuals with roles and responsibilities in the supply chain.

CIA Levels
Confidentiality	low
Integrity	low
Availability	low

Overlays
CMMC, Classified, DAF Baseline, Int-A, Int-B, Int-C

CSF Categories
ID.BE-1, ID.SC-1, ID.SC-2, ID.SC-3

Related Controls

The controls below (if any) were marked by NIST as being related to SR-3.

Control	Description
CA-2	a: Select the appropriate assessor or assessment team for the type of assessment to be conducted; b: Develop a control assessment plan that describes the scope of the assessment including: 1: Controls and control enhancements under assessment; 2: Assessment procedures to be used to determine control effectiveness; and 3: Assessment environment, assessment team, and assessment roles and responsibilities; c: Ensure the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment; d: Assess the controls in the system and its environment of operation [the frequency at which to assess controls in the system and its environment of operation is defined;] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security and privacy requirements; e: Produce a control assessment report that document the results of the assessment; and f: Provide the results of the control assessment to [individuals or roles to whom control assessment results are to be provided are defined;].
MA-2	a: Schedule, document, and review records of maintenance, repair, and replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements; b: Approve and monitor all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location; c: Require that [personnel or roles required to explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance or repairs is/are defined;] explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement; d: Sanitize equipment to remove the following information from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement: [information to be removed from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement is defined;]; e: Check all potentially impacted controls to verify that the controls are still functioning properly following maintenance, repair, or replacement actions; and f: Include the following information in organizational maintenance records: [information to be included in organizational maintenance records is defined;].
MA-6	Obtain maintenance support and/or spare parts for [system components for which maintenance support and/or spare parts are obtained are defined;] within [time period within which maintenance support and/or spare parts are to be obtained after a failure are defined;] of failure.
PE-3	a: Enforce physical access authorizations at [entry and exit points to the facility in which the system resides are defined;] by: 1: Verifying individual access authorizations before granting access to the facility; and 2: Controlling ingress and egress to the facility using [one or more of "{{ insert: param, pe-03_odp.03 }} "/"guards"]; b: Maintain physical access audit logs for [entry or exit points for which physical access logs are maintained are defined;]; c: Control access to areas within the facility designated as publicly accessible by implementing the following controls: [physical access controls to control access to areas within the facility designated as publicly accessible are defined;]; d: Escort visitors and control visitor activity [circumstances requiring visitor escorts and control of visitor activity are defined;]; e: Secure keys, combinations, and other physical access devices; f: Inventory [physical access devices to be inventoried are defined;] every [frequency at which to inventory physical access devices is defined;] ; and g: Change combinations and keys [one of ] and/or when keys are lost, combinations are compromised, or when individuals possessing the keys or combinations are transferred or terminated.
PE-16	a: Authorize and control [one of ] entering and exiting the facility; and b: Maintain records of the system components.
PL-8	a: Develop security and privacy architectures for the system that: 1: Describe the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information; 2: Describe the requirements and approach to be taken for processing personally identifiable information to minimize privacy risk to individuals; 3: Describe how the architectures are integrated into and support the enterprise architecture; and 4: Describe any assumptions about, and dependencies on, external systems and services; b: Review and update the architectures [frequency for review and update to reflect changes in the enterprise architecture;] to reflect changes in the enterprise architecture; and c: Reflect planned architecture changes in security and privacy plans, Concept of Operations (CONOPS), criticality analysis, organizational procedures, and procurements and acquisitions.
PM-30	a: Develop an organization-wide strategy for managing supply chain risks associated with the development, acquisition, maintenance, and disposal of systems, system components, and system services; b: Implement the supply chain risk management strategy consistently across the organization; and c: Review and update the supply chain risk management strategy on [the frequency for reviewing and updating the supply chain risk management strategy is defined;] or as required, to address organizational changes.
SA-2	a: Determine the high-level information security and privacy requirements for the system or system service in mission and business process planning; b: Determine, document, and allocate the resources required to protect the system or system service as part of the organizational capital planning and investment control process; and c: Establish a discrete line item for information security and privacy in organizational programming and budgeting documentation.
SA-3	a: Acquire, develop, and manage the system using [system development life cycle is defined;] that incorporates information security and privacy considerations; b: Define and document information security and privacy roles and responsibilities throughout the system development life cycle; c: Identify individuals having information security and privacy roles and responsibilities; and d: Integrate the organizational information security and privacy risk management process into system development life cycle activities.
SA-4	Include the following requirements, descriptions, and criteria, explicitly or by reference, using [one or more of "standardized contract language"/"{{ insert: param, sa-04_odp.02 }} "] in the acquisition contract for the system, system component, or system service: a: Security and privacy functional requirements; b: Strength of mechanism requirements; c: Security and privacy assurance requirements; d: Controls needed to satisfy the security and privacy requirements. e: Security and privacy documentation requirements; f: Requirements for protecting security and privacy documentation; g: Description of the system development environment and environment in which the system is intended to operate; h: Allocation of responsibility or identification of parties responsible for information security, privacy, and supply chain risk management; and i: Acceptance criteria.
SA-5	a: Obtain or develop administrator documentation for the system, system component, or system service that describes: 1: Secure configuration, installation, and operation of the system, component, or service; 2: Effective use and maintenance of security and privacy functions and mechanisms; and 3: Known vulnerabilities regarding configuration and use of administrative or privileged functions; b: Obtain or develop user documentation for the system, system component, or system service that describes: 1: User-accessible security and privacy functions and mechanisms and how to effectively use those functions and mechanisms; 2: Methods for user interaction, which enables individuals to use the system, component, or service in a more secure manner and protect individual privacy; and 3: User responsibilities in maintaining the security of the system, component, or service and privacy of individuals; c: Document attempts to obtain system, system component, or system service documentation when such documentation is either unavailable or nonexistent and take [actions to take when system, system component, or system service documentation is either unavailable or nonexistent are defined;] in response; and d: Distribute documentation to [personnel or roles to distribute system documentation to is/are defined;].
SA-8	Apply the following systems security and privacy engineering principles in the specification, design, development, implementation, and modification of the system and system components: [one of ].
SA-9	a: Require that providers of external system services comply with organizational security and privacy requirements and employ the following controls: [controls to be employed by external system service providers are defined;]; b: Define and document organizational oversight and user roles and responsibilities with regard to external system services; and c: Employ the following processes, methods, and techniques to monitor control compliance by external service providers on an ongoing basis: [processes, methods, and techniques employed to monitor control compliance by external service providers are defined;].
SA-10	Require the developer of the system, system component, or system service to: a: Perform configuration management during system, component, or service [one or more of "design"/"development"/"implementation"/"operation"/"disposal"]; b: Document, manage, and control the integrity of changes to [configuration items under configuration management are defined;]; c: Implement only organization-approved changes to the system, component, or service; d: Document approved changes to the system, component, or service and the potential security and privacy impacts of such changes; and e: Track security flaws and flaw resolution within the system, component, or service and report findings to [personnel to whom security flaws and flaw resolutions within the system, component, or service are reported is/are defined;].
SA-15	a: Require the developer of the system, system component, or system service to follow a documented development process that: 1: Explicitly addresses security and privacy requirements; 2: Identifies the standards and tools used in the development process; 3: Documents the specific tool options and tool configurations used in the development process; and 4: Documents, manages, and ensures the integrity of changes to the process and/or tools used in development; and b: Review the development process, standards, tools, tool options, and tool configurations [frequency at which to review the development process, standards, tools, tool options, and tool configurations is defined;] to determine if the process, standards, tools, tool options and tool configurations selected and employed can satisfy the following security and privacy requirements: [one of ].
SC-7	a: Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system; b: Implement subnetworks for publicly accessible system components that are [one of "physically"/"logically"] separated from internal organizational networks; and c: Connect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture.
SC-29	Employ a diverse set of information technologies for the following system components in the implementation of the system: [system components requiring a diverse set of information technologies to be employed in the implementation of the system are defined;].
SC-30	Employ the following concealment and misdirection techniques for [systems for which concealment and misdirection techniques are to be employed are defined;] at [time periods to employ concealment and misdirection techniques for systems are defined;] to confuse and mislead adversaries: [concealment and misdirection techniques to be employed to confuse and mislead adversaries potentially targeting systems are defined;].
SC-38	Employ the following operations security controls to protect key organizational information throughout the system development life cycle: [operations security controls to be employed to protect key organizational information throughout the system development life cycle are defined;].
SI-7	a: Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: [one of ] ; and b: Take the following actions when unauthorized changes to the software, firmware, and information are detected: [one of ].
SR-6	Assess and review the supply chain-related risks associated with suppliers or contractors and the system, system component, or system service they provide [the frequency at which to assess and review the supply chain-related risks associated with suppliers or contractors and the systems, system components, or system services they provide is defined;].
SR-9	Implement a tamper protection program for the system, system component, or system service.
SR-11	a: Develop and implement anti-counterfeit policy and procedures that include the means to detect and prevent counterfeit components from entering the system; and b: Report counterfeit system components to [one or more of "source of counterfeit component"/"{{ insert: param, sr-11_odp.02 }} "/"{{ insert: param, sr-11_odp.03 }} "].

Enhancements

The controls below (if any) add on to the requirements of SR-3.

Control	Description
SR-3(1)	Employ a diverse set of sources for the following system components and services: [one of ].
SR-3(2)	Employ the following controls to limit harm from potential adversaries identifying and targeting the organizational supply chain: [controls to limit harm from potential supply chain adversaries are defined;].
SR-3(3)	Ensure that the controls included in the contracts of prime contractors are also included in the contracts of subcontractors.

Related CCIs

The CCIs below are tied to SR-3.

CCI	Definition
CCI-005080	Establish a process of processes to identify and address weaknesses or deficiencies in the supply chain elements of organization-defined system or system components in coordination with organization-defined supply chain personnel.
CCI-005081	Defines the system or system processes which establish a process or processes for identifying and addressing weaknesses or deficiencies in the supply chain elements.
CCI-005082	Defines the supply chain personnel who, in coordination, establish a process or processes for identifying and addressing weaknesses or deficiencies in the supply chain elements.
CCI-005083	Establish a process of processes to identify and address weaknesses or deficiencies in the processes of organization-defined system or system components in coordination with organization-defined supply chain personnel.
CCI-005084	Defines the system or system processes which establish a process or processes for identifying and addressing weaknesses or deficiencies in the supply chain processes.
CCI-005085	Defines the supply chain personnel who, in coordination, establish a process or processes for identifying and addressing weaknesses or deficiencies in the supply chain processes.
CCI-005086	Employ the following controls to protect against supply chain risks to the system, system component, or system service.
CCI-005087	Limit the harm or consequences from supply chain-related events.
CCI-005088	Defines the supply chain controls employed for protecting against supply chain risks to the system, system component, or system service.
CCI-005089	Document the selected and implemented supply chain processes and controls in security and privacy plans, supply chain risk management plan, or organization-defined document.
CCI-005090	Defines the document which contains supply chain processes and controls.