Supply Chain Risk¶
Mitigating Supply Chain Risk¶
KSI-SCR-MIT
Changelog:
-
2026-10-13: Updated control mappings: added ac-19, ra-3, sa-11.1, sa-11.2, sa-15, sa-16, sa-17, sa-21, sa-4, sa-4.1, sa-4.2, sa-4.5, sa-4.9, sa-9.1, sa-9.2, sa-9.5, si-7.15, sr-2, sr-3.
-
2026-06-24: Official launch of the FedRAMP Consolidated Rules for 2026.
Persistently identify, review, and mitigate potential supply chain risks.
Related SP 800-53 Controls: AC-19, AC-20, CA-07 (04), RA-03, RA-03 (01), SA-10, SA-11, SA-11 (01), SA-11 (02), SA-15, SA-15 (03), SA-16, SA-17, SA-21, SA-22, SA-04, SA-04 (01), SA-04 (02), SA-04 (05), SA-04 (09), SA-09, SA-09 (01), SA-09 (02), SA-09 (05), SC-18, SI-07 (01), SI-07 (15), SR-02, SR-03, SR-05, SR-06
Terms: Persistently
Monitoring Supply Chain Risk¶
KSI-SCR-MON
Changelog:
-
2026-10-13: Updated control mappings: added ac-19, ca-2.3, ra-3, sr-3.
-
2026-06-24: Official launch of the FedRAMP Consolidated Rules for 2026.
Third party software information resources are automatically monitored for upstream vulnerabilities using mechanisms that may include contractual notification requirements or active monitoring services.
Related SP 800-53 Controls: AC-19, AC-20, CA-02 (03), CA-03, IR-06 (03), PS-07, RA-03, RA-05, SA-09, SI-05, SR-03, SR-05, SR-06, SR-08
Terms: Information Resource, Vulnerability