# SR-02 Supply Chain Risk Management Plan

NIST SP 800-53 control. Family: SR Supply Chain Risk Management. Function: preventative. Baselines: low, moderate, high. Mapping licence: CC BY-SA 4.0.

Statement: a. Develop a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal of the following systems, system components or system services: [Assignment: organization-defined systems, system components, or system services]; b. Review and update the supply chain risk management plan [Assignment: organization-defined frequency] or as required, to address threat, organizational or environmental changes; and c. Protect the supply chain risk management plan from unauthorized disclosure and modification.
Guidance: The dependence on products, systems, and services from external providers, as well as the nature of the relationships with those providers, present an increasing level of risk to an organization. Threat actions that may increase security or privacy risks include unauthorized production, the insertion or use of counterfeits, tampering, theft, insertion of malicious software and hardware, and poor manufacturing and development practices in the supply chain. Supply chain risks can be endemic or systemic within a system element or component, a system, an organization, a sector, or the Nation. Managing supply chain risk is a complex, multifaceted undertaking that requires a coordinated effort across an organization to build trust relationships and communicate with internal and external stakeholders. Supply chain risk management (SCRM) activities include identifying and assessing risks, determining appropriate risk response actions, developing SCRM plans to document response actions, and monitoring performance against plans. The SCRM plan (at the system-level) is implementation specific, providing policy implementation, requirements, constraints and implications. It can either be stand-alone, or incorporated into system security and privacy plans. The SCRM plan addresses managing, implementation, and monitoring of SCRM controls and the development/sustainment of systems across the SDLC to support mission and business functions. Because supply chains can differ significantly across and within organizations, SCRM plans are tailored to the individual program, organizational, and operational contexts. Tailored SCRM plans provide the basis for determining whether a technology, service, system component, or system is fit for purpose, and as such, the controls need to be tailored accordingly. Tailored SCRM plans help organizations focus their resources on the most critical mission and business functions based on mission and business requirements and their risk environment. Supply chain risk management plans include an expression of the supply chain risk tolerance for the organization, acceptable supply chain risk mitigation strategies or controls, a process for consistently evaluating and monitoring supply chain risk, approaches for implementing and communicating the plan, a description of and justification for supply chain risk mitigation measures taken, and associated roles and responsibilities. Finally, supply chain risk management plans address requirements for developing trustworthy, secure, privacy-protective, and resilient system components and systems, including the application of the security design principles implemented as part of life cycle-based systems security engineering processes (see SA-08).

## Enhancements (1)
- SR-02(01) Establish SCRM Team. Baselines: low, moderate, high
Each enhancement's statement: /api/v1/controls/SR-02?fields=enhancements

## Patterns that use it (7)
- Critical (3): SP-018 Information Security Management System; SP-027 Secure LLM Usage; SP-042 Third Party Risk Management
- Important (3): SP-028 Secure DevOps Pipeline Pattern; SP-047 Secure Agentic AI Frameworks; SP-049 AI in Security Operations (draft)
- Standard (1): SP-030 API Security

## Clauses by framework (63 frameworks)
- iso_27001_2022: 4.2, A.5.19, A.5.20, A.5.21, A.8.30. OSA's own, not in NIST's crosswalk: 4.2
- iso_27002_2022: 5.19, 5.21
- cobit_2019: APO10
- nist_csf_2: GV.RM-01, GV.RM-03, GV.RM-04, GV.SC-01, GV.SC-02, GV.SC-03, GV.SC-04, GV.SC-05, GV.SC-07, GV.SC-08, GV.SC-09, GV.SC-10, ID.AM-04, ID.IM-04. OSA's own, not in NIST's crosswalk: GV.SC-04, GV.SC-05, GV.SC-07
- cis_controls_v8: CIS 15, CIS 15.3
- soc2_tsc: CC3.1, CC3.2, CC4.1, CC9.1, CC9.2, CC9.2-POF1
- iso_42001_2023: A.10.2, A.10.3
- nis2: Art. 21(2)(d)
- mas_trm: 16
- pra_op_resilience: SS1/21-5.3, SS2/21-3.1, SS2/21-8.1, SS2/21-16.1
- anssi: Hygiene.36, Hygiene.42, SecNumCloud.16.1
- osfi_b13: B-13.4.1
- finma_circular: IV.F(100), V(101), V(102), V(103)
- gdpr: Art.28(1), Art.28(3)(c), Art.28(3)(h)
- dora: Art.28(4), Art.28(5)
- bio2: 5.19, 5.21
- rbi_csf: Annex1.11, ITGRCA.10
- dnb_good_practice: DNB.14.2
- cra: CRA.I.1
- cbb_tm: TM-15
- cbuae: CR-12
- nca_ecc: 4-1
- qatar_nia: SD
- sama_csf: 4.1, 4.2
- uae_ia: T10
- bog_cisd: CISD-XI, CISD-XII, CISD-XVI
- bom_ctrm: 3.9
- cbe_csf: OVM-1
- cbn_csf: Part2.4
- popia: s20, s21
- sa_js2: JS2-8.7
- bot_cyber: Ch5.1
- cpmi_pfmi: CG.ID
- eba_ict: 3.2.3
- ecb_croe: CROE.2.2.3
- ffiec_is: II.C.14, II.C.20
- hipaa_sr: §164.314(a)(1)
- iosco_cyber: GOV-5, PROT-7
- nydfs_500: 500.11
- sebi_cscrf: GV.SC
- nerc_cip: CIP-013-2
- nrc_73_54: RG5.71-C-SR
- ferc_cip: Order 829, Order 850
- doe_c2m2: THIRD
- api_1164: Sec 12
- awia: AWWA Sec 7
- iaea_nss: Sec 6
- pci_pts: G
- tiber_eu: TIBER.PROV
- isae_3402: Clause 7
- fca_sysc_13: SYSC 13.9.1
- hitrust_csf: 05.b
- iso_27799: 14.1, 15.1
- lloyds_ms: MS8.8, MS9.3, MS13.1
- naic_ds: 4D
- nhs_dspt: NDG-10.1, NDG-10.4
- solvency_ii: Art.49(1), Art.49(2), DR.272, EIOPA-Cloud-GL3
- csa_ccm_v4: STA-02, STA-07, STA-08
- csa_aicm: STA-02, STA-07, STA-08, STA-16
- mica: Art.66(1)
- basel_sco60: SCO60.4, SCO60.41, SCO60.54, SCO60.83, SCO60.84
- bssc: GSP-07
- sec_custody_digital: SEC-CD-09, SEC-CD-10
OSA's mapping for iso_27001_2022 and nist_csf_2 takes NIST's published crosswalk as its base. A clause not marked as OSA's own is in that crosswalk.

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/SR-02
- Clauses only: /api/v1/controls/SR-02?fields=mappings
- Page for people: /controls/sr-02/
- Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.