Stage 4: Mature

Outcome

The program manages risk from its suppliers as deliberately as its own, and uses assessment results, incidents and exercises to improve its policies and priorities.

Artifacts to produce

Family	Artifacts	Main controls
Supply chain risk management	Supply Chain Risk Management Plan; supplier assessment questionnaire	SR-2, SR-6

Templates available now

Artifact	Type	Main controls	Status
Supply Chain Risk Management Policy	Policy	SR-1	Draft
Supply Chain Risk Management Decision Worksheet	Decision worksheet	SR-1	Draft
Supplier Assessment Questionnaire	Form or register	SR-6, SR-5, RA-3(1)	Draft
Supply Chain Risk Management Plan	Plan	SR-2, SR-2(1), SR-3	Draft

Decisions to make

• Which suppliers and products are critical enough to assess, and how deeply.
• Which lessons from assessments, incidents and exercises change the Risk Management Strategy or a family policy.

Roles

Role	Responsibility in this stage
Chief Information Security Officer	Owns the supply chain plan and the program’s improvement cycle
Procurement	Puts security requirements into contracts and runs supplier assessments
Senior leader	Reapproves the strategy when risk tolerance changes

RMF Prepare tasks this stage carries out

This stage adds no new organization-level Prepare task from SP 800-37 Rev. 2. It revisits the ones set up earlier: the risk management strategy (P-2) and organization risk assessment (P-3) as results come in, and the common controls (P-5) as services change. The mapping is the author’s judgment.

Done when

• Critical suppliers are identified and assessed.
• The Supply Chain Risk Management Plan is approved.
• The strategy and policies have each been reviewed against the last year’s assessments and incidents.