Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems
Jeremy Miller2, Julie Snyder > 2.3. Cybersecurity Supply Chain Risk Management Plan

2.3. Cybersecurity Supply Chain Risk Management Plan

The system-level C-SCRM plan draws from the organization's overarching C-SCRM strategy10 to
address cybersecurity risks at the system level throughout the supply chain, including
commercial-off-the-shelf (COTS) products, turn-key solutions, and support services. It
incorporates organization-level priorities, policies, and risk tolerances to address system-level
risks and interdependencies with inherited or system-specific controls that enhance trust and
protection. The C-SCRM plan:
• Identifies policy implementations, requirements, constraints, and implications that are
specific to the cybersecurity supply chain at the system level and that derive from the
organization-level C-SCRM strategy and mission/business process risk priorities;
• Describes the system's approach to managing supply chain risks that are associated with
the research, development, design, manufacturing, acquisition, delivery, integration,
operations, maintenance, and disposal of its components or services;
• Describes the system in the context of the organizational supply chain risk tolerance,
including acceptable supply chain risk response strategies or controls, a process for the
continuous evaluation and monitoring of supply chain risks, approaches for
implementing and communicating the plan, and a description of and justification for the
supply chain risk mitigation measures that are taken;
• Includes supplier and component inventories that specify the associated criticality to the
system and identify key individuals who fill supply chain-relevant roles;
• Considers security control implementation information that is specific to supply chain
considerations, system diagrams, and interdependencies with other systems; and
• Defines the relationships between key suppliers and the system owner by establishing
roles and responsibilities, setting stakeholder expectations, managing supplier
performance, and enumerating policies, processes, and procedures for supplier
governance that can evolve as the system C-SCRM plan matures.
Different types of systems may have specific considerations that can be addressed in the
C-SCRM plan, such as the system architecture, security category, or type of technology used
within the system. [SP800-161] Appendix A, C-SCRM Security Controls, provides an enhanced
overlay with selected [SP800-53] security and privacy controls along with implementation
guidelines to support the effective implementation of the controls from a supply chain risk
management perspective.
10 The cybersecurity supply chain refers to the linked set of resources and processes between and among multiple levels of the organizational
hierarchy. In general practice, C-SCRM is at the nexus of SCRM and information security, so C-SCRM and SCRM refer to the same concept for
the purposes of this publication. Other organizations may use different definitions of C-SCRM and SCRM, which are outside of the scope of this
publication. This publication does not address many of the non-cybersecurity aspects of SCRM.