SR-2 asks you to develop a plan for managing supply chain risks across the life cycle of defined systems, components or services, to review and update it on a schedule or as threats and conditions change, and to protect the plan from unauthorized disclosure and modification. NIST 800-53 binds US federal systems and, by contract, some others. It is a sensible template for any company asked for a supplier risk plan.
What it means in practice
The guidance explains that dependence on external providers carries increasing risk. Threat actions include unauthorized production, counterfeits, tampering, theft, insertion of malicious software and hardware, and poor manufacturing and development practices. It says the plan spans research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal.
The plan is a risk document, so it belongs next to your risk register. SR-2.1 adds establishing an SCRM team.
Evidence to collect
- The plan itself with scope, version and approval.
- The systems and services it covers.
- Review records and updates after changes.
- Access controls on the plan.
- The SCRM team roster, if you have one.
Common gaps
- Plan limited to a vendor list with no life cycle view.
- No review after a supplier incident.
- The plan is open to everyone, though it describes weaknesses.
How to implement it
List your critical suppliers and software dependencies, name the main risks for each, and record the treatment. Link entries to your risk register.
Click through it at your own pace, or open it full screen.
Quick check
Why protect the plan from disclosure?
It documents your supply chain weaknesses and treatments, which are useful to an adversary.
