SR-7 asks you to employ operations security controls to protect supply chain information for a system, component or service. The specific controls are chosen by the organization. NIST 800-53 binds US federal systems and, by contract, some others. Everyone else can use it as a reference.
What it means in practice
The guidance says supply chain OPSEC extends the scope of OPSEC to suppliers and potential suppliers. OPSEC means identifying critical information, looking at which of your actions an adversary can observe, working out what could be pieced together from those indicators, and applying countermeasures.
A buyer announcing which product they are about to adopt, or a public job post that lists your full toolchain, can both reveal more than intended.
Evidence to collect
- A list of supply chain information you treat as sensitive, such as supplier lists and build tooling details.
- Rules for what may be shared publicly or with prospective suppliers.
- NDAs or sharing agreements with suppliers.
- Review records for public postings, repositories and procurement notices.
Common gaps
- Public repositories exposing internal vendor names or pipeline details.
- Sharing architecture documents with bidders before an NDA.
- No owner for the question.
How to implement it
Write a short list of what counts as critical supply chain information, assign an owner, and add a review step before public posts and RFPs.
Quick check
Is SR-7 only for government buyers?
The control comes from federal guidance, but the idea applies to any company whose supplier information would help an attacker.
