If you open the Rev 5 catalog and look for SA-12, Supply Chain Protection, you will find a withdrawn control. NIST incorporated it into the SR family, Supply Chain Risk Management. Older assessments and some contracts still cite SA-12, so it helps to know where it went.
800-53 binds US federal systems, and others through contract. For the rest of us it is a reference, and the SR family is the better place to look.
What it means in practice
The withdrawn SA-12 carried enhancements that are a good summary of the topic: SA-12.1 Acquisition Strategies / Tools / Methods, SA-12.2 Supplier Reviews, SA-12.3 Trusted Shipping and Warehousing, SA-12.4 Diversity of Suppliers, SA-12.5 Limitation of Harm, SA-12.6 Minimizing Procurement Time, SA-12.7 Assessments Prior to Selection / Acceptance / Update and SA-12.8 Use of All-source Intelligence.
The theme is simple. Know who supplies your components, check them before you depend on them, and limit the damage if one fails.
Evidence to collect
- A list of suppliers and software components you depend on.
- Records of review before selection or an update.
- A plan for what you do if a supplier is compromised.
Common gaps
Treating the supplier list as a purchasing record instead of a risk record. Also, reviewing a vendor once at signing and never again.
How to implement it
Cite SR controls in new documents, not SA-12. Keep a component inventory, review suppliers on a schedule, and note an exit path for critical ones. Software dependencies count as suppliers, so scan them.
What an auditor may ask
Expect questions such as: which suppliers do you rely on for production, how did you review them before you chose them, and what happens if one is breached tomorrow? Answer with dated records, not recollection. A supplier register with a last review date and a named owner covers most of it.
Quick check
Where did SA-12 go?
It was withdrawn and incorporated into the SR family in Rev 5.
