{"data":{"id":"SR-05","name":"Acquisition Strategies, Tools, and Methods","family":"SR","family_name":"Supply Chain Risk Management","withdrawn":false,"description":"Employ the following acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks: [Assignment: organization-defined acquisition strategies, contract tools, and procurement methods].","supplemental_guidance":"The use of the acquisition process provides an important vehicle to protect the supply chain. There are many useful tools and techniques available, including obscuring the end use of a system or system component, using blind or filtered buys, requiring tamper-evident packaging, or using trusted or controlled distribution. The results from a supply chain risk assessment can guide and inform the strategies, tools, and methods that are most applicable to the situation. Tools and techniques may provide protections against unauthorized production, theft, tampering, insertion of counterfeits, insertion of malicious software or backdoors, and poor development practices throughout the system development life cycle. Organizations also consider providing incentives for suppliers who implement controls, promote transparency into their processes and security and privacy practices, provide contract language that addresses the prohibition of tainted or counterfeit components, and restrict purchases from untrustworthy suppliers. Organizations consider providing training, education, and awareness programs for personnel regarding supply chain risk, available mitigation strategies, and when the programs should be employed. Methods for reviewing and protecting development plans, documentation, and evidence are commensurate with the security and privacy requirements of the organization. Contracts may specify documentation protection requirements.","enhancements":[{"id":"SR-05(01)","name":"Adequate Supply","statement":"Employ the following controls to ensure an adequate supply of [Assignment: organization-defined critical system components]: [Assignment: organization-defined controls].","baselines":[]},{"id":"SR-05(02)","name":"Assessments Prior to Selection, Acceptance, Modification, or Update","statement":"Assess the system, system component, or system service prior to selection, acceptance, modification, or update.","baselines":[]}],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"SR-05","name":"Acquisition Strategies, Tools, and Methods","description":"Employ the following acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks: [Assignment: organization-defined acquisition strategies, contract tools, and procurement methods].","discussion":"The use of the acquisition process provides an important vehicle to protect the supply chain. There are many useful tools and techniques available, including obscuring the end use of a system or system component, using blind or filtered buys, requiring tamper-evident packaging, or using trusted or controlled distribution. The results from a supply chain risk assessment can guide and inform the strategies, tools, and methods that are most applicable to the situation. Tools and techniques may provide protections against unauthorized production, theft, tampering, insertion of counterfeits, insertion of malicious software or backdoors, and poor development practices throughout the system development life cycle. Organizations also consider providing incentives for suppliers who implement controls, promote transparency into their processes and security and privacy practices, provide contract language that addresses the prohibition of tainted or counterfeit components, and restrict purchases from untrustworthy suppliers. Organizations consider providing training, education, and awareness programs for personnel regarding supply chain risk, available mitigation strategies, and when the programs should be employed. Methods for reviewing and protecting development plans, documentation, and evidence are commensurate with the security and privacy requirements of the organization. Contracts may specify documentation protection requirements.","related_controls":["AT-03","SA-02","SA-03","SA-04","SA-05","SA-08","SA-09","SA-10","SA-15","SR-06","SR-09","SR-10","SR-11"],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":true,"changes_from_rev4":"New control family introduced in Rev 5"}},"compliance_mappings":{"iso_27001_2022":["A.5.20","A.5.21","A.5.23"],"iso_27002_2022":["5.19","5.21"],"cobit_2019":["APO10"],"pci_dss_v4":[],"nist_csf_2":["GV.OC-02","GV.OC-05","GV.SC-02","GV.SC-05","GV.SC-06","GV.SC-09","GV.SC-10","ID.AM-08","ID.IM-01","ID.IM-02","ID.IM-03","ID.RA-09","ID.RA-10"],"cis_controls_v8":["CIS 15"],"soc2_tsc":["CC3.3","CC9.1"],"finos_ccc":[],"iso_42001_2023":["A.10.3"],"iec_62443":[],"asd_e8":[],"nis2":["Art. 21(2)(d)"],"apra_cps_234":[],"mas_trm":[],"pra_op_resilience":[],"bsi_grundschutz":[],"anssi":["Hygiene.42","SecNumCloud.16.1"],"osfi_b13":["B-13.4.1"],"finma_circular":["IV.F(100)","V(101)","V(111)","VI(112)"],"gdpr":["Art.28(3)(a)","Art.28(3)(h)"],"dora":["Art.28(5)","Art.30(2)(a)"],"bio2":["5.19","5.21"],"rbi_csf":["Annex1.11","ITGRCA.10"],"fisc":[],"lgpd_bcb":[],"hkma_tme1":[],"mlps_2":[],"dnb_good_practice":["DNB.14.2"],"cra":[],"swift_cscf":[],"cbb_tm":["TM-15"],"cbuae":["CR-12"],"nca_ecc":["4-1"],"qatar_nia":["SD"],"sama_csf":["4.1"],"uae_ia":["T10"],"bog_cisd":["CISD-XII","CISD-XVI"],"bom_ctrm":["3.9"],"cbe_csf":["OVM-1"],"cbn_csf":["Part2.4"],"popia":["s21"],"sa_js2":["JS2-8.7"],"bot_cyber":["Ch5.1"],"cpmi_pfmi":["CG.PR","PFMI.P17"],"eba_ict":["3.2.3"],"ecb_croe":["CROE.2.2.3"],"ffiec_is":["II.C.14"],"iosco_cyber":["PROT-7"],"nydfs_500":["500.11"],"sebi_cscrf":["GV.SC"],"nerc_cip":["CIP-013-2"],"nrc_73_54":["RG5.71-C-SR"],"tsa_psd":[],"ieee_1686":[],"ferc_cip":["Order 829"],"doe_c2m2":["THIRD"],"api_1164":["Sec 12"],"awia":[],"iaea_nss":["Sec 6"],"pci_pts":["G"],"fips_140":[],"cbest":[],"tiber_eu":[],"pci_hsm":[],"common_criteria":[],"isae_3402":["Clause 7"],"fca_sysc_13":["SYSC 13.9.2"],"fda_21_cfr_11":[],"fda_cyber":["524B-1","SBOM-1","ST-4"],"hitrust_csf":["05.b"],"iso_27799":["15.1","15.2"],"lloyds_ms":["MS8.8"],"naic_ds":["4D"],"nhs_dspt":["NDG-10.1","NDG-10.4"],"pra_ss1_23":[],"solvency_ii":["Art.49(1)","DR.272","EIOPA-Cloud-GL3"],"owasp_masvs_v2":[],"csa_ccm_v4":[],"csa_aicm":[],"ccss_v9":[],"mica":["Art.66(1)","Art.66(3)"],"basel_sco60":["SCO60.54"],"bssc":["GSP-07","TIS-06"],"sec_custody_digital":[],"dpdpa":[]},"attack_techniques":[{"id":"T1195","name":"Supply Chain Compromise","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Employing rigorous acquisition strategies including vendor vetting, software provenance verification, and contract security requirements reduces the risk of supply chain compromise during procurement."},{"id":"T1505","name":"Server Software Component","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Acquisition controls that require security testing and code review of third-party server components before deployment prevent adversaries from introducing malicious server software through the supply chain."},{"id":"T1554","name":"Compromise Host Software Binary","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Supply chain acquisition strategies that verify software binary integrity through hash comparison and code signing validation detect compromised host software introduced during distribution."},{"id":"T1601","name":"Modify System Image","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Acquisition controls requiring firmware provenance verification and integrity validation for network equipment prevent adversaries from introducing modified system images through the hardware supply chain."},{"id":"T1059.002","name":"AppleScript","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Supply chain vetting for macOS software that evaluates AppleScript automation capabilities identifies applications that adversaries could exploit for AppleScript-based execution after deployment."},{"id":"T1195.001","name":"Compromise Software Dependencies and Development Tools","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Acquisition strategies that audit software dependencies, enforce package signing, and verify build pipeline integrity prevent adversaries from compromising development tools and libraries before procurement."},{"id":"T1195.002","name":"Compromise Software Supply Chain","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Vendor security assessments, software composition analysis, and binary verification during acquisition prevent adversaries from introducing compromised software through vendor distribution channels."},{"id":"T1195.003","name":"Compromise Hardware Supply Chain","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Hardware supply chain controls including tamper-evident packaging, vendor attestation, and component provenance verification prevent adversaries from introducing compromised hardware during procurement."},{"id":"T1204.003","name":"Malicious Image","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Acquisition strategies for container images that enforce registry controls, image signing, and vulnerability scanning prevent procurement and deployment of malicious container images."},{"id":"T1505.001","name":"SQL Stored Procedures","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Acquisition controls that require security review of database extensions and stored procedures before deployment prevent introduction of malicious SQL components through vendor packages."},{"id":"T1505.002","name":"Transport Agent","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Supply chain vetting for email server components that validates Transport Agent integrity prevents adversaries from introducing malicious mail pipeline components through software procurement."},{"id":"T1505.004","name":"IIS Components","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Acquisition strategies for web server modules that require IIS component signing and vendor verification prevent adversaries from introducing malicious web server components during deployment."},{"id":"T1546.006","name":"LC_LOAD_DYLIB Addition","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Supply chain verification of macOS application binaries for unauthorized LC_LOAD_DYLIB entries prevents adversaries from distributing applications pre-configured to load malicious dynamic libraries."},{"id":"T1601.001","name":"Patch System Image","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Acquisition controls requiring cryptographic verification of firmware images against vendor-provided hashes detect tampered network device images introduced during procurement or distribution."},{"id":"T1601.002","name":"Downgrade System Image","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Supply chain management practices that enforce minimum firmware versions and prevent procurement of devices with outdated firmware eliminate downgrade attack vectors at acquisition time."}],"metadata":{"last_reviewed":"2026-10-03","review_notes":"2026-10-03: iso_27001_2022 A.5.20, A.5.23 added from NIST's SP 800-53 Rev 5 to ISO/IEC 27001:2022 crosswalk (OLIR entry 155), which OSA's mapping now takes as its base. 2026-10-03: nist_csf_2 GV.OC-02, GV.OC-05, GV.SC-02, GV.SC-05, GV.SC-09, GV.SC-10, ID.AM-08, ID.IM-01, ID.IM-02, ID.IM-03 added from NIST's CSF 2.0 to SP 800-53 Rev 5.2.0 crosswalk (OLIR entry 186), which OSA's mapping now takes as its base. 2026-10-03: statement, discussion and related controls taken from NIST SP 800-53 Release 5.2.0, which this file lacked.","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-040","SP-042"]}}