Supply Chain Risk¶
Mitigating Supply Chain Risk¶
KSI-SCR-MIT
Changelog:
-
2026-10-31: Changed wording order without any material impact to align with KSI standard language. Was: Persistently identify, review, and mitigate potential supply chain risks.
-
2026-10-13: Updated control mappings: added ac-19, ra-3, sa-11.1, sa-11.2, sa-15, sa-16, sa-17, sa-21, sa-4, sa-4.1, sa-4.2, sa-4.5, sa-4.9, sa-9.1, sa-9.2, sa-9.5, si-7.15, sr-2, sr-3.
-
2026-06-24: Official launch of the FedRAMP Consolidated Rules for 2026.
Potential supply chain risks are persistently identified, reviewed, and mitigated.
Related SP 800-53 Controls: AC-19, AC-20, CA-07 (04), RA-03, RA-03 (01), SA-10, SA-11, SA-11 (01), SA-11 (02), SA-15, SA-15 (03), SA-16, SA-17, SA-21, SA-22, SA-04, SA-04 (01), SA-04 (02), SA-04 (05), SA-04 (09), SA-09, SA-09 (01), SA-09 (02), SA-09 (05), SC-18, SI-07 (01), SI-07 (15), SR-02, SR-03, SR-05, SR-06
Terms: Persistently
Monitoring Supply Chain Risk¶
KSI-SCR-MON
Changelog:
-
2026-10-13: Updated control mappings: added ac-19, ca-2.3, ra-3, sr-3.
-
2026-06-24: Official launch of the FedRAMP Consolidated Rules for 2026.
Third party software information resources are automatically monitored for upstream vulnerabilities using mechanisms that may include contractual notification requirements or active monitoring services.
Related SP 800-53 Controls: AC-19, AC-20, CA-02 (03), CA-03, IR-06 (03), PS-07, RA-03, RA-05, SA-09, SI-05, SR-03, SR-05, SR-06, SR-08
Terms: Information Resource, Vulnerability