rmfdb

Description	The organization conducts a supplier review prior to entering into a contractual agreement to acquire the information system, system component, or information system service.
Assessment Procedure	SA-12(2).1
Organization Guidance	The organization being inspected/assessed documents and implements a process to conduct a supplier review prior to entering into a contractual agreement to acquire the information system, system component, or information system service. Examples of items that can be considered in the review are the supplier's: 1. Organization and process certifications; 2. Security policies, procedures, and activities across the lifecycle; 3. Supply chain and the criteria and methodology for selecting/managing their suppliers/service providers; 4. Financials to determine if the supplier is financially stable; 5. Foreign Ownership, Control, and Influence; 6. Past performance and any documented supply chain incidents; 7. Business relationships; and 8. Maturity of business processes. The organization must maintain a record of supplier review.
Auditor Guidance	The organization conducting the inspection/assessment obtains and examines the documented process as well as the record of supplier review to ensure the organization being inspected/assessed documents and implements a process to conduct a supplier review prior to entering into a contractual agreement to acquire the information system, system component, or information system service.

Control

Supply Chain Protection | Supplier Reviews

STIG Rules

Loading...