View source for Practice RA.L3-3.11.6e Details

'''Source of Reference: The official [https://dodcio.defense.gov/cmmc/Resources-Documentation/ CMMC Level 3 Assessment Guide] from the Department of Defense Chief Information Officer (DoD CIO).'''

For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.

== RA.L3-3.11.6E – SUPPLY CHAIN RISK RESPONSE ==
=== SECURITY REQUIREMENT ===
Assess, respond to, and monitor supply chain risks associated with organizational systems and system components.
=== ASSESSMENT OBJECTIVES [NIST SP 800-172A] ===
Determine if:
: [a] Supply chain risks associated with organizational systems and system components are identified;
: [b] Supply chain risks associated with organizational systems and system components are assessed;
: [c] Supply chain risks associated with organizational systems and system components are responded to; and
: [d] Supply chain risks associated with organizational systems and system components are monitored.
=== POTENTIAL ASSESSMENT METHODS AND OBJECTS [NIST SP 800-172A] ===
'''Examine'''

[SELECT FROM: Risk assessment policy; procedures addressing organizational assessments of risk; security planning policy and procedures; supply chain risk management plan; security plan; risk assessment; risk assessment results; risk assessment reviews; risk assessment updates; threat intelligence information; other relevant documents or records].

'''Interview'''

[SELECT FROM: Organizational personnel responsible for information security; organizational personnel responsible for risk assessments; organizational personnel responsible for supply chain risk management].

'''Test'''

[SELECT FROM: Mechanisms supporting, conducting, documenting, reviewing, disseminating, and updating risk assessments].
=== DISCUSSION [NIST SP 800-172] ===
Supply chain events include disruption, use of defective components, insertion of counterfeits, theft, malicious development practices, improper delivery practices, and insertion of malicious code. These events can have a significant impact on a system and its information and, therefore, can also adversely impact organizational operations (i.e., mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation. The supply chain-related events may be unintentional or malicious and can occur at any point during the system life cycle. An analysis of supply chain risk can help an organization identify systems or components for which additional supply chain risk mitigations are required.

[NIST SP 800-30] provides guidance on risk assessments, threat assessments, and risk analyses. [NIST SP 800-161 Rev. 1] provides guidance on supply chain risk management.
=== FURTHER DISCUSSION ===
Organizations will have varying policies, definitions, and actions for this requirement. It is important for a single organization to be consistent and to build a process that makes sense for their organization, strategy, unique supply chain, and the technologies available to them.

'''Example '''

You are responsible for information security in your organization, which holds and processes CUI. One of your responsibilities is to manage risk associated with your supply chain that may provide an entry point for the adversary. First, you acquire threat information by subscribing to reports that identify supply chain attacks in enough detail that you are able to identify the risk points in your organization’s supply chain [a]. You create an organization-defined prioritized list of risks the organization may encounter and determine the responses to be implemented to mitigate those risks [b,c].

In addition to incident information, the intelligence provider also makes recommendations for monitoring and auditing your supply chain. You assess, integrate, correlate, and analyze this information so you can use it to acquire monitoring tools to help identify supply chain events that could be an indicator of an incident. This monitoring tool provides visibility of the entire attack surface, including your vendors’ security posture [d]. Second, you analyze the incident information in the intelligence report to help identify defensive tools that will help respond to each of those known supply chain attack techniques as soon as possible after such an incident is detected, thus mitigating risk associated with known techniques.

'''Potential Assessment Considerations'''
* Has the organization prioritized risks to the supply chain [a,b]?
* Does the organization have viable service-level agreements that describe and enable responses to supply chain incidents [c,d]?
=== KEY REFERENCES ===
* NIST SP 800-172 3.11.6e