PM-30 Supply Chain Risk Management Strategy

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Not in a baseline	Organization	1 (0 in a baseline)

Related controls: CM-10, PM-9, SR-1, SR-2, SR-3, SR-4, SR-5, SR-6, SR-7, SR-8, SR-9, SR-11

Control statement

• a. Develop an organization-wide strategy for managing supply chain risks associated with the development, acquisition, maintenance, and disposal of systems, system components, and system services;
• b. Implement the supply chain risk management strategy consistently across the organization; and
• c. Review and update the supply chain risk management strategy on [Assignment: organization-defined frequency] or as required, to address organizational changes.

NIST discussion

An organization-wide supply chain risk management strategy includes an unambiguous expression of the supply chain risk appetite and tolerance for the organization, acceptable supply chain risk mitigation strategies or controls, a process for consistently evaluating and monitoring supply chain risk, approaches for implementing and communicating the supply chain risk management strategy, and the associated roles and responsibilities. Supply chain risk management includes considerations of the security and privacy risks associated with the development, acquisition, maintenance, and disposal of systems, system components, and system services. The supply chain risk management strategy can be incorporated into the organization’s overarching risk management strategy and can guide and inform supply chain policies and system-level supply chain risk management plans. In addition, the use of a risk executive function can facilitate a consistent, organization-wide application of the supply chain risk management strategy. The supply chain risk management strategy is implemented at the organization and mission/business levels, whereas the supply chain risk management plan (see SR-2 ) is implemented at the system level.

Control enhancements

PM-30(1) Suppliers of Critical or Mission-essential Items

Baselines: Not in a baseline

Identify, prioritize, and assess suppliers of critical or mission-essential technologies, products, and services.

Discussion and assessment objectives for PM-30(1)

The identification and prioritization of suppliers of critical or mission-essential technologies, products, and services is paramount to the mission/business success of organizations. The assessment of suppliers is conducted using supplier reviews (see SR-6 ) and supply chain risk assessment processes (see RA-3(1) ). An analysis of supply chain risk can help an organization identify systems or components for which additional supply chain risk mitigations are required.

Determine if:

• PM-30(01)[01] suppliers of critical or mission-essential technologies, products, and services are identified;
• PM-30(01)[02] suppliers of critical or mission-essential technologies, products, and services are prioritized;
• PM-30(01)[03] suppliers of critical or mission-essential technologies, products, and services are assessed.

Examine: Supply chain risk management strategy; organization-wide risk management strategy; enterprise risk management documents; inventory records or suppliers; assessment and prioritization documentation; critical or mission-essential technologies, products, and service documents or records; other relevant documents or records.

Interview: Organizational personnel with supply chain risk management responsibilities; organizational personnel with information security responsibilities; organizational personnel with acquisition responsibilities; organizational personnel with enterprise risk management responsibilities.

Test: Organizational processes for identifying, prioritizing, and assessing critical or mission-essential technologies, products, and services; organizational processes for maintaining an inventory of suppliers; organizational process for associating suppliers with critical or mission-essential technologies, products, and services.

Assessment objectives (SP 800-53A)

Objectives and methods for PM-30

Determine if:

• PM-30a.
  • PM-30a.[01] an organization-wide strategy for managing supply chain risks is developed;
  • PM-30a.[02] the supply chain risk management strategy addresses risks associated with the development of systems;
  • PM-30a.[03] the supply chain risk management strategy addresses risks associated with the development of system components;
  • PM-30a.[04] the supply chain risk management strategy addresses risks associated with the development of system services;
  • PM-30a.[05] the supply chain risk management strategy addresses risks associated with the acquisition of systems;
  • PM-30a.[06] the supply chain risk management strategy addresses risks associated with the acquisition of system components;
  • PM-30a.[07] the supply chain risk management strategy addresses risks associated with the acquisition of system services;
  • PM-30a.[08] the supply chain risk management strategy addresses risks associated with the maintenance of systems;
  • PM-30a.[09] the supply chain risk management strategy addresses risks associated with the maintenance of system components;
  • PM-30a.[10] the supply chain risk management strategy addresses risks associated with the maintenance of system services;
  • PM-30a.[11] the supply chain risk management strategy addresses risks associated with the disposal of systems;
  • PM-30a.[12] the supply chain risk management strategy addresses risks associated with the disposal of system components;
  • PM-30a.[13] the supply chain risk management strategy addresses risks associated with the disposal of system services;
• PM-30b. the supply chain risk management strategy is implemented consistently across the organization;
• PM-30c. the supply chain risk management strategy is reviewed and updated [Assignment: organization-defined frequency] or as required to address organizational changes.

Examine: Supply chain risk management strategy; organizational risk management strategy; enterprise risk management documents; other relevant documents or records.

Interview: Organizational personnel with supply chain risk management responsibilities; organizational personnel with information security responsibilities; organizational personnel with acquisition responsibilities; organizational personnel with enterprise risk management responsibilities.

Policy statement

• The Chief Information Security Officer shall develop an organization-wide strategy for managing supply chain risks associated with the development, acquisition, maintenance and disposal of systems, system components and system services. (PM-30a)
• The Chief Information Security Officer shall implement the supply chain risk management strategy consistently across the organization. (PM-30b)
• The Chief Information Security Officer shall review and update the supply chain risk management strategy Fill in: the frequency for reviewing and updating the supply chain risk management strategy Typical: annually, and whenever organizational changes require it. (PM-30c)

PM-30(1) Suppliers of critical or mission-essential items

• The Chief Information Security Officer shall identify and prioritize the suppliers of critical or mission-essential technologies, products and services. (PM-30(1))
• The Chief Information Security Officer shall assess each of those suppliers for supply chain risk. (PM-30(1))

From the Program Management Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

PM-30 asks for an organization-wide strategy for managing supply chain risks in the development, acquisition, maintenance and disposal of systems, system components and system services (a). You implement it consistently across the organization (b), and review and update it at a set frequency or when organizational changes require it (c). PM-30 is in no SP 800-53B baseline. It still applies to any organization that adopts the Program Management policy as written, because the policy has its clause, as PM-7(1) does.

NIST’s PM-30 discussion says the strategy includes an unambiguous statement of the organization’s supply chain risk appetite and tolerance, acceptable mitigation strategies or controls, a process for consistently evaluating and monitoring supply chain risk, approaches for implementing and communicating the strategy, and the roles and responsibilities. It covers security and privacy risks. It can be part of the overall risk management strategy (PM-9), and it guides supply chain policy (SR-1) and each system’s supply chain risk management plan (SR-2). The strategy works at the organization and mission or business levels; the plan works at the system level. A risk executive (function) (PM-29) can help apply it consistently.

SP 800-161 Rev. 1 (May 2022, updated November 1, 2024; current as of October 2026) calls it the C-SCRM strategy and pairs it with an implementation plan of initiatives, timelines and responsible parties, which can be or be part of a plan of action and milestones. Appendix D.1 gives an outline: purpose, authority and compliance, strategic objectives, implementation plan and progress tracking, roles and responsibilities, definitions, and revision and maintenance. It says the strategy should anchor to the overarching risk management strategy, and that the strategy and the implementation plan may be one document or several.

Common implementations. The Program Management policy has the Chief Information Security Officer develop, implement and review the strategy. The kit has no separate strategy template, so organizations take one of two routes:

• A supply chain section in the Risk Management Strategy, which NIST’s discussion allows. Its section 1 already says supply chain risk follows the tolerance that strategy sets.
• A separate document that follows the SP 800-161 Rev. 1 Appendix D.1 outline, for an organization with many suppliers or a dedicated supply chain risk management team (SR-2(1)).

Either way, it would pass an assessment if it:

• States the supply chain risk tolerance in terms a system owner can apply, such as no unassessed supplier for a critical component
• Covers all four life cycle activities the control names, development, acquisition, maintenance and disposal, for systems, components and services, since SP 800-53A assesses each
• Names the accepted mitigations: the contract terms in the acquisition security requirements standard, supplier assessments on the supplier assessment questionnaire (SR-6), and supply chain risk assessments (RA-3(1))
• Says how supply chain risk is monitored, through the continuous monitoring strategy (PM-31)
• Has an implementation plan with milestones and owners

Each system’s Supply Chain Risk Management Plan names the strategy in section 1 and applies its tolerance in section 2.2. That is how assessors see consistent implementation (b).

Organization-defined parameters. From templates/policy/pm/. Typical value, which your organization may set differently:

Parameter	Typical value
Strategy review and update frequency (c)	Annually, and whenever organizational changes require it

SP 800-161 Rev. 1’s sample text (Appendix D.1.1.7) suggests a review every three to five years at a minimum in the federal environment, with interim revisions after policy changes and significant events. The typical value reviews more often, because supplier relationships change faster than that.

Evidence assessors ask for.

• The approved strategy and its implementation plan, with the progress against the plan
• The parts that address development, acquisition, maintenance and disposal (a)
• System supply chain risk management plans, contracts and supplier assessments that follow the strategy (b)
• The record of the last review, and of updates after organizational changes (c)
• For PM-30(1), the inventory of suppliers with their criticality and priority, and their assessments

Inheritance. PM-30 is implemented once, for the whole organization, and every system relies on it. NIST’s PM-1 discussion treats program management controls as independent of any system and distinct from common controls. Each system applies the strategy through its supply chain risk management plan.

Common findings.

• A strategy that covers buying only, with nothing on maintenance or disposal.
• No stated supply chain risk tolerance, so each program decides for itself.
• An implementation plan with no owners or dates, or none at all.
• Cloud and other service providers missing from the supplier inventory.
• Critical suppliers assessed before the contract was signed and never again.
• No update after a supplier was acquired, breached or excluded.

Enhancements. PM-30(1) asks you to identify, prioritize and assess the suppliers of critical or mission-essential technologies, products and services. It is in no baseline, and it applies when the Program Management policy keeps its clause. NIST’s discussion says suppliers are assessed through supplier reviews (SR-6) and supply chain risk assessment (RA-3(1)). SP 800-161 Rev. 1, section 3.1.1, has the C-SCRM strategy and implementation plan start from a current inventory of supplier relationships and the products and services each provides, grouped by importance to the mission, to focus attention on critical suppliers. The criticality analysis (RA-9) identifies which items are critical. PM-30(1) has no parameters. Typical choices, which your organization may make differently:

Choice	Typical value
Which suppliers are critical	Suppliers of the components and services the criticality analysis identifies as critical, and of the services mission-essential functions depend on
How critical suppliers are prioritized	By the impact of their failure or compromise on mission-essential functions, and by reliance on a single source
How often critical suppliers are assessed	Before award or renewal, and each year after that

Federal systems (as of October 2026). Under the Federal Acquisition Supply Chain Security Act of 2018, the head of each executive agency is responsible for assessing supply chain risk, which includes developing an overall supply chain risk management strategy and implementation plan, and policies and processes to guide and govern supply chain risk management activities (41 U.S.C. § 1326(a) and (b)(1), United States Code, 2024 edition). Section 1326(a) also has agencies prioritize those assessments by the criticality of the mission, system, component, service or asset, as PM-30(1) does. The subchapter terminates on December 31, 2033 (41 U.S.C. § 1328). OMB Circular A-130, Appendix I, section 3.b(8), has agencies implement supply chain risk management principles throughout the system development life cycle.

Artifacts

• Program Management Decision Worksheet
• Program Management Policy