Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems
Jeremy Miller2, Julie Snyder > 1. Introduction

1. Introduction

All systems that process, store, and transmit information within an organization need
safeguards that adhere to an organization-wide risk management strategy to address security,
privacy, and cybersecurity supply chain risks. A standardized method of presenting risk
management information about a system can help organizational leadership, risk managers,
and system personnel understand the safeguards that are designed to protect the organization
and system assets.
System plans collectively refer to the system security plan, system privacy plan, and
cybersecurity supply chain risk management (C-SCRM) plan, which describe the assets and
individuals being protected within the scope of a system and the risks associated with
information exchanges that involve systems outside the scope (e.g., database sharing, cloud- or
web-based service, simple file exchange).
• The system security plan describes the system security requirements, including the
controls selected to protect the confidentiality, integrity, and availability of the system
and its information.
• The system privacy plan describes the system privacy risk management requirements,
including the controls selected to address predictability, manageability, and
disassociability.1
• The C-SCRM plan describes the system's C-SCRM requirements, including the controls to
manage, implement, and monitor the supply chain and to develop and sustain the
system across mission and business functions.
The NIST Risk Management Framework (RMF) [SP800-37] provides a flexible methodology for
organizations and systems to manage security, privacy, and supply chain risks. The expected
outputs of RMF tasks (see Appendix A) inform the system plan elements (see Sec. 3.1) that
describe the purpose and scope of the system; the environment of operation; the information
types created, collected, disseminated, used, stored, and disposed of; the data flows within the
environment and with interconnected systems; the control implementation details; and the
roles and responsibilities of individuals associated with the system. Organizations determine
the level of detail and areas of focus that are appropriate for each system plan element based
on the information needed to support:
• System assessment, ongoing assessment, and continuous monitoring activities by
system personnel and assessment teams
• Risk-based decisions by senior leadership (i.e., authorizing official, senior agency official
for privacy)
Organizations are encouraged to automate the collection of system information (see Sec. 3.3)
using information management tools with a central data repository, including Governance, Risk,
and Compliance (GRC); Security Orchestration, Automation, and Response (SOAR); and Security
Information and Event Management (SIEM) tools. Automation can control the availability and
1 The NIST Privacy Framework [NIST PF] explains the privacy engineering objectives of predictability, manageability, and disassociability.
shareability of collected system information, enabling personnel responsible for the system to
access an appropriate level of detail based on their system risk management role.
While there is a shift toward automating information capture and managing system plans using
standardized machine-readable formats,2 organizations with limited resources to automate
may rely on the manual preparation of traditional system plan artifacts.