{"data":{"id":"PM-30","name":"Supply Chain Risk Management Strategy","family":"PM","family_name":"Program Management","withdrawn":false,"description":"a. Develop an organization-wide strategy for managing supply chain risks associated with the development, acquisition, maintenance, and disposal of systems, system components, and system services;\nb. Implement the supply chain risk management strategy consistently across the organization; and\nc. Review and update the supply chain risk management strategy on [Assignment: organization-defined frequency] or as required, to address organizational changes.","supplemental_guidance":"An organization-wide supply chain risk management strategy includes an unambiguous expression of the supply chain risk appetite and tolerance for the organization, acceptable supply chain risk mitigation strategies or controls, a process for consistently evaluating and monitoring supply chain risk, approaches for implementing and communicating the supply chain risk management strategy, and the associated roles and responsibilities. Supply chain risk management includes considerations of the security and privacy risks associated with the development, acquisition, maintenance, and disposal of systems, system components, and system services. The supply chain risk management strategy can be incorporated into the organization’s overarching risk management strategy and can guide and inform supply chain policies and system-level supply chain risk management plans. In addition, the use of a risk executive function can facilitate a consistent, organization-wide application of the supply chain risk management strategy. The supply chain risk management strategy is implemented at the organization and mission/business levels, whereas the supply chain risk management plan (see SR-02) is implemented at the system level.","enhancements":[{"id":"PM-30(01)","name":"Suppliers of Critical or Mission-essential Items","statement":"Identify, prioritize, and assess suppliers of critical or mission-essential technologies, products, and services.","baselines":[]}],"baseline_low":false,"baseline_moderate":false,"baseline_high":false,"nist_800_53":{"rev5":{"id":"PM-30","name":"Supply Chain Risk Management Strategy","description":"a. Develop an organization-wide strategy for managing supply chain risks associated with the development, acquisition, maintenance, and disposal of systems, system components, and system services;\nb. Implement the supply chain risk management strategy consistently across the organization; and\nc. Review and update the supply chain risk management strategy on [Assignment: organization-defined frequency] or as required, to address organizational changes.","discussion":"An organization-wide supply chain risk management strategy includes an unambiguous expression of the supply chain risk appetite and tolerance for the organization, acceptable supply chain risk mitigation strategies or controls, a process for consistently evaluating and monitoring supply chain risk, approaches for implementing and communicating the supply chain risk management strategy, and the associated roles and responsibilities. Supply chain risk management includes considerations of the security and privacy risks associated with the development, acquisition, maintenance, and disposal of systems, system components, and system services. The supply chain risk management strategy can be incorporated into the organization’s overarching risk management strategy and can guide and inform supply chain policies and system-level supply chain risk management plans. In addition, the use of a risk executive function can facilitate a consistent, organization-wide application of the supply chain risk management strategy. The supply chain risk management strategy is implemented at the organization and mission/business levels, whereas the supply chain risk management plan (see SR-02) is implemented at the system level.","related_controls":["CM-10","PM-09","SR-01","SR-02","SR-03","SR-04","SR-05","SR-06","SR-07","SR-08","SR-09","SR-11"],"baseline_low":false,"baseline_moderate":false,"baseline_high":false,"baseline_privacy":false,"new_in_rev5":true,"changes_from_rev4":"New control in Rev 5. Formalizes supply chain risk management strategy."}},"compliance_mappings":{"iso_27001_2022":["4.4","6.2","7.5"],"iso_27002_2022":[],"cobit_2019":[],"pci_dss_v4":[],"nist_csf_2":["DE.AE-04","GV.OC-02","GV.OC-05","GV.OV-01","GV.OV-02","GV.RM-03","GV.RM-04","GV.RM-05","GV.RM-06","GV.RM-07","GV.SC-01","GV.SC-03","GV.SC-09","ID.RA-06"],"cis_controls_v8":[],"soc2_tsc":[],"finos_ccc":[],"iso_42001_2023":[],"iec_62443":[],"asd_e8":[],"nis2":[],"apra_cps_234":[],"mas_trm":[],"pra_op_resilience":["SS2/21-16.1"],"bsi_grundschutz":[],"anssi":[],"osfi_b13":[],"finma_circular":[],"gdpr":[],"dora":[],"bio2":[],"rbi_csf":["Annex1.11","ITGRCA.10"],"fisc":[],"lgpd_bcb":[],"hkma_tme1":[],"mlps_2":[],"dnb_good_practice":[],"cra":["CRA.I.1"],"swift_cscf":[],"cbuae":["CR-12"],"qatar_nia":["GV"],"sama_csf":["1.8","4.1"],"bog_cisd":["CISD-XVI"],"bom_ctrm":["1.5","3.9"],"cbe_csf":["CTO-11","OVM-1"],"cbn_csf":["Part2.4"],"sa_js2":["JS2-8.7"],"bcbs_239":["Principle 1"],"bot_cyber":["Ch5.1","Ch5.2"],"ffiec_is":["II.C.20"],"nydfs_500":["500.11"],"sebi_cscrf":["GV.RM","GV.SC"],"nerc_cip":[],"nrc_73_54":[],"tsa_psd":[],"ieee_1686":[],"ferc_cip":[],"doe_c2m2":["THIRD"],"api_1164":[],"awia":[],"iaea_nss":[],"pci_pts":[],"fips_140":[],"cbest":[],"tiber_eu":[],"pci_hsm":[],"common_criteria":[],"isae_3402":["Clause 7"],"fca_sysc_13":["SYSC 13.9.1"],"fda_21_cfr_11":[],"fda_cyber":[],"hitrust_csf":[],"iso_27799":[],"lloyds_ms":["MS10.1"],"naic_ds":["4D"],"nhs_dspt":[],"pra_ss1_23":[],"solvency_ii":[],"owasp_masvs_v2":[],"csa_ccm_v4":[],"csa_aicm":[],"ccss_v9":[],"mica":[],"basel_sco60":[],"bssc":[],"sec_custody_digital":[],"dpdpa":[]},"attack_techniques":[],"metadata":{"last_reviewed":"2026-10-03","review_notes":"Generated from NIST SP 800-53 Rev 5 with compliance mappings extracted from framework-coverage data 2026-10-02: iso_27001_2022 clauses taken from NIST's SP 800-53 Rev 5 to ISO/IEC 27001:2022 crosswalk (OLIR, v1.0.0). OSA had none. 2026-10-03: nist_csf_2 DE.AE-04, GV.OC-02, GV.OC-05, GV.OV-01, GV.OV-02, GV.RM-03, GV.RM-04, GV.RM-05, GV.RM-06, GV.RM-07, ID.RA-06 added from NIST's CSF 2.0 to SP 800-53 Rev 5.2.0 crosswalk (OLIR entry 186), which OSA's mapping now takes as its base.","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-034"]}}