Supply Chain Risk Management (SR)
The Supply Chain Risk Management family has 12 active controls in SP 800-53 release 5.2.0. “Yes” marks membership in the SP 800-53B baselines.
| Control | Title | Low | Moderate | High | Privacy |
|---|---|---|---|---|---|
| SR-1 | Policy and Procedures | Yes | Yes | Yes | |
| SR-2 | Supply Chain Risk Management Plan | Yes | Yes | Yes | |
| SR-3 | Supply Chain Controls and Processes | Yes | Yes | Yes | |
| SR-4 | Provenance | ||||
| SR-5 | Acquisition Strategies, Tools, and Methods | Yes | Yes | Yes | |
| SR-6 | Supplier Assessments and Reviews | Yes | Yes | ||
| SR-7 | Supply Chain Operations Security | ||||
| SR-8 | Notification Agreements | Yes | Yes | Yes | |
| SR-9 | Tamper Resistance and Detection | Yes | |||
| SR-10 | Inspection of Systems or Components | Yes | Yes | Yes | |
| SR-11 | Component Authenticity | Yes | Yes | Yes | |
| SR-12 | Component Disposal | Yes | Yes | Yes |
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.