Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

sa-12(12)

supply chain protection  | inter-organizational agreements

assessment objective:

Determine if the organization establishes, with entities involved in the supply chain for the information system, system component, or information system service,:

sa-12(12)[1]

inter-organizational agreements; and

sa-12(12)[2]

inter-organizational procedures.

potential assessment methods and objects:

Examine: [select from: System and services acquisition policy; procedures addressing supply chain protection; acquisition documentation; service-level agreements; acquisition contracts for the information system, system component, or information system service; inter-organizational agreements and procedures; other relevant documents or records].

Interview: [select from: Organizational personnel with system and services acquisition responsibilities; organizational personnel with information security responsibilities; organizational personnel with supply chain protection responsibilities].

Test: [select from: Organizational processes for establishing inter-organizational agreements and procedures with supply chain entities].