Supply Chain Risk Management Decision Worksheet

Supply Chain Risk Management Decision Worksheet template: Every decision the Supply Chain Risk Management family of NIST SP 800-53 Rev. 5 forces, with typical values and who decides, per baseline, as a spreadsheet.

Type	Program stage	Status	Template version	NIST basis
Decision worksheet	Mature	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

Every decision the Supply Chain Risk Management family asks your organization to make before its policy and procedures can be final: the family’s key questions, then each organization-defined parameter of every SR control in the baseline, with a typical value where the Supply Chain Risk Management Policy gives one. Download the spreadsheet, fill the “Your value” column with the people who decide, and carry the values into the policy’s highlighted fields.

Typical values are starting points, not recommendations for every system. “Who decides” defaults to the role accountable for the family policy; many organizations delegate system-level values to the system owner.

Downloads

Variant	Spreadsheet
Low	CSV
Moderate	CSV
High	CSV

Decisions (Moderate baseline)

38 decisions.

Decision	Control	Typical value	Who decides
Who leads supply chain risk management, and who sits on the team?	SR-2(1), SR-3	A lead the Chief Information Security Officer designates chairs a standing team with members from information security, privacy, acquisition and contracting, legal counsel, information technology, the mission or business owners and business continuity, under a written charter; the team meets each quarter and whenever an acquisition or supplier notification needs its review.	Chief Information Security Officer
Which systems, components and services get the most supply chain scrutiny?	SR-2, SR-3, SR-6, SR-9, SR-10	Every system has a supply chain risk management plan; the components and services the criticality analysis (RA-9) identifies as critical, and their suppliers, get the supplier assessments, notification terms, inspections and (for High systems) tamper protection the plan selects.	System owner, with the supply chain risk management team
Where may the organization buy system components, and how are suppliers vetted?	SR-5, SR-6, SR-11	Hardware and software come only from original manufacturers, their authorized distributors or resellers, or suppliers the supply chain risk management team has assessed; each supplier of a critical component or service is assessed before award or renewal and each year, with the same core risk factors applied to every supplier.	Chief Information Security Officer, with the procurement office
What must suppliers tell the organization, and how quickly?	SR-8	Contracts for critical components and services require notice of a supply chain compromise within the incident notice time of the acquisition security requirements standard, sharing of the results of independent assessments or audits, and the same notification terms in the supplier’s agreements with its own suppliers.	Chief Information Security Officer, with the procurement office
How are counterfeit or tampered components found and handled?	SR-10, SR-11, SR-11(1), SR-11(2)	Components are checked on receipt and before first use, critical components are inspected each year and after repair or travel, software is verified by signature or published hash, and a suspect component is quarantined, handled as an incident and reported to its source, its original manufacturer and CISA; staff who handle or buy hardware are trained to spot counterfeits.	Chief Information Security Officer
How are components, documentation and tools disposed of so they cannot re-enter the supply chain?	SR-12	Storage is sanitized under the media sanitization procedure, keys, credentials and licenses are removed, paper is shredded, and hardware goes only to a contracted disposal or recycling provider that certifies destruction or recycling by serial number, with each disposal recorded.	System owner
Personnel or roles to whom supply chain risk management policy is to be disseminated to	SR-1	Everyone within its scope, through the policy library	Chief Information Security Officer
Personnel or roles to whom supply chain risk management procedures are disseminated to	SR-1	The people who carry them out, and the system owners	Chief Information Security Officer
Select one or more: organization-level; mission/business process-level; system-level	SR-1	Organization-level	Chief Information Security Officer
An official to manage the development, documentation, and dissemination of the supply chain risk management policy and procedures	SR-1	Chief Information Security Officer	Chief Information Security Officer
The frequency at which the current supply chain risk management policy is reviewed and updated	SR-1	Annually	Chief Information Security Officer
Events that require the current supply chain risk management policy to be reviewed and updated	SR-1	Assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines	Chief Information Security Officer
The frequency at which the current supply chain risk management procedure is reviewed and updated	SR-1	Annually	Chief Information Security Officer
Events that require the supply chain risk management procedures to be reviewed and updated	SR-1	The same events as the policy, and changes to the systems, tools or services the procedures describe	Chief Information Security Officer
Systems, system components, or system services for which a supply chain risk management plan is developed	SR-2	Each system, including the components and services the criticality analysis (RA-9) identifies as critical and the external services the system depends on	Chief Information Security Officer
The frequency at which to review and update the supply chain risk management plan	SR-2	Annually, and at each life cycle milestone or gate review and each significant contracting action, such as a new contract, a renewal or a change of supplier for a critical component or service	Chief Information Security Officer
The personnel, roles, and responsibilities of the supply chain risk management team	SR-2(1)	A lead the Chief Information Security Officer designates, and representatives of information security, privacy, acquisition and contracting, legal counsel, information technology, the mission or business owners, and business continuity, each with the responsibilities the team charter assigns	Chief Information Security Officer
Supply chain risk management activities	SR-2(1)	Maintaining the supply chain risk management strategy and plans, setting the criteria for supplier assessments and reviewing their results (SR-6), reviewing acquisitions of critical components and services before award, coordinating the response to supply chain compromise notifications (SR-8), and tracking supply chain risks until they are resolved	Chief Information Security Officer
The system or system component requiring a process or processes to identify and address weaknesses or deficiencies	SR-3	Each system and the components and services the criticality analysis (RA-9) identifies as critical	Chief Information Security Officer
Supply chain personnel with whom to coordinate the process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes	SR-3	The supply chain risk management team (SR-2(1)), the procurement office, and the designated supply chain contacts of the suppliers and contractors involved	Chief Information Security Officer
Supply chain controls employed to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events	SR-3	The controls the supply chain risk management plan selects, including at least the supply chain terms of the acquisition security requirements standard (SA-4, SR-5), supplier assessments (SR-6), notification agreements (SR-8), inspection of components on receipt and after repair (SR-10), anti-counterfeit measures (SR-11) and controlled disposal (SR-12)	Chief Information Security Officer
Select one or more: security and privacy plans; supply chain risk management plan; organization-defined document (see its row below)	SR-3	The supply chain risk management plan, summarized and referenced in the security and privacy plans	Chief Information Security Officer
The document identifying the selected and implemented supply chain processes and controls	SR-3	See the selection above	Chief Information Security Officer
Acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks	SR-5	The supply chain terms of the acquisition security requirements standard, including identification of the origin of critical components and flow-down to subcontractors; contract language prohibiting counterfeit or tainted components; purchase of hardware and software only from original manufacturers, their authorized distributors or resellers, or suppliers the supply chain risk management team has assessed; a supplier risk assessment before award as part of source selection for critical components and services; and tamper-evident packaging and tracked delivery for hardware	Chief Information Security Officer
The frequency at which to assess and review the supply chain-related risks associated with suppliers or contractors and the systems, system components, or system services they provide	SR-6	Before each contract award or renewal, and annually for suppliers of critical components and services	Chief Information Security Officer
Select one or more: notification of supply chain compromises; organization-defined results of assessments or audits (see its row below)	SR-8	Notification of supply chain compromises, and the results of assessments or audits	Chief Information Security Officer
Information for which agreements and procedures are to be established	SR-8	The results of independent security assessments, audits or attestations of the supplier’s products, services and development or manufacturing processes, and any finding that affects a product or service the organization uses	Chief Information Security Officer
Systems or system components that require inspection	SR-10	The components the criticality analysis (RA-9) identifies as critical, and any component that has been outside organization-controlled areas, such as for off-site repair or travel	Chief Information Security Officer
Select one or more: at random; at organization-defined frequency (see its row below); upon organization-defined indications of need for inspection (see its row below)	SR-10	Before first use and annually thereafter, and upon indications of a need for inspection	Chief Information Security Officer
Frequency at which to inspect systems or system components	SR-10	Before first use and annually thereafter	Chief Information Security Officer
Indications of the need for an inspection of systems or system components	SR-10	Damaged or altered packaging or seals; a change in a component’s specifications, factory location or the entity it is bought from; return from off-site repair; and return of a device from travel to a location the organization designates as high risk	Chief Information Security Officer
Select one or more: source of counterfeit component; organization-defined external reporting organizations (see its row below); organization-defined personnel or roles (see its row below)	SR-11	The source of the counterfeit component, the original manufacturer and CISA, and the Chief Information Security Officer, the supply chain risk management team and the system owner	Chief Information Security Officer
External reporting organizations to whom counterfeit system components are to be reported	SR-11	The original manufacturer of the genuine component, and CISA	Chief Information Security Officer
Personnel or roles to whom counterfeit system components are to be reported	SR-11	The Chief Information Security Officer, the supply chain risk management team and the system owner	Chief Information Security Officer
Personnel or roles requiring training to detect counterfeit system components (including hardware, software, and firmware)	SR-11(1)	Staff who receive, inspect, install or repair hardware, procurement staff who buy system components, and the supply chain risk management team	Chief Information Security Officer
System components requiring configuration control	SR-11(2)	All system components, including servers, network and security devices, storage devices and end-user devices	Chief Information Security Officer
Data, documentation, tools, or system components to be disposed of	SR-12	System components, media and devices that hold or have held organizational information, configurations or credentials; system, design and supply chain documentation, including shipping and delivery records; and development, test and maintenance tools	Chief Information Security Officer
Techniques and methods for disposing of data, documentation, tools, or system components	SR-12	Sanitization of storage by the method the media sanitization procedure sets for it (MP-6), removal of cryptographic keys, credentials and licenses, destruction of paper documentation by shredding or incineration, and transfer of hardware only to a disposal or recycling provider under contract that certifies destruction or recycling by serial number	Chief Information Security Officer