Limitation of Harm
LOW MODERATE HIGHRequirements NIST SOURCE
Employ the following controls to limit harm from potential adversaries identifying and targeting the organizational supply chain: [controls].
Discussion (NIST Supplemental Guidance)
Controls that can be implemented to reduce the probability of adversaries successfully identifying and targeting the supply chain include avoiding the purchase of custom or non-standardized configurations, employing approved vendor lists with standing reputations in industry, following pre-agreed maintenance schedules and update and patch delivery mechanisms, maintaining a contingency plan in case of a supply chain event, using procurement carve-outs that provide exclusions to commitments or obligations, using diverse delivery routes, and minimizing the time between purchase decisions and delivery.
Implementation Guidance
Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.
No engineering interpretation has been authored for SR-3(2) yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.
Assessment
Assessment Objectives
- controls to limit harm from potential supply chain adversaries are defined;
- <SR-03(02)_ODP controls> are employed to limit harm from potential adversaries identifying and targeting the organizational supply chain.
Examine
[SELECT FROM: Supply chain risk management policy and procedures; supply chain risk management plan; system and services acquisition policy; configuration management policy; procedures addressing supply chain protection; procedures addressing the integration of information security requirements into the acquisition process; procedures addressing the baseline configuration of the system; configuration management plan; system design documentation; system architecture and associated configuration documentation; solicitation documentation; acquisition documentation; acquisition contracts for the system, system component, or system service; threat assessments; vulnerability assessments; list of security safeguards to be taken to protect the organizational supply chain against potential supply chain threats; system security plan; other relevant documents or records].
Interview
[SELECT FROM: Organizational personnel with system and services acquisition responsibilities; organizational personnel with information security responsibilities; organizational personnel with supply chain risk management responsibilities].
Test
[SELECT FROM: Organizational processes for defining and employing safeguards to limit harm from adversaries of the organizational supply chain; mechanisms supporting and/or implementing the definition and employment of safeguards to protect the organizational supply chain].
Overlays
STIGs & CCIs
No STIG checks or CCI mappings are currently loaded for SR-3(2). This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.
Learn more about STIG/CCI integration →Evidence
Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.
Policy
- Supply chain risk management policy and procedures
- supply chain risk management plan
- system and services acquisition policy
- system security plan
Configuration
- configuration management policy
- procedures addressing the baseline configuration of the system
- configuration management plan
- system design documentation
- system architecture and associated configuration documentation
Testing
- Organizational processes for defining and employing safeguards to limit harm from adversaries of the organizational supply chain
- mechanisms supporting and/or implementing the definition and employment of safeguards to protect the organizational supply chain
Other Records
- procedures addressing supply chain protection
- procedures addressing the integration of information security requirements into the acquisition process
- solicitation documentation
- acquisition documentation
- acquisition contracts for the system, system component, or system service
- threat assessments
- vulnerability assessments
- list of security safeguards to be taken to protect the organizational supply chain against potential supply chain threats
- other relevant documents or records