N
|
controlSR-2

Supply Chain Risk Management Plan (SR-2)

Develop a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal of the following systems, system components or system services: [organization-defined]; Review and update the supply chain risk management plan [organization-defined] or as required, to address threat, organizational or environmental changes; and Protect the supply chain risk management plan from unauthori

Security Baselines

LOWMODERATEHIGH
supply-chainacquisitionthird-partyrisk

Why These Connect

Maps To23

These are equivalent or closely aligned requirements in other frameworks.

Baselined In3

This control is included in the linked security baseline (LOW, MODERATE, or HIGH).

Supports28

These related controls work together — a change to one may affect the others.

Mitigates1

This control helps defend against or reduce the risk of the linked threat technique.

Enhances1

These enhancements add specific capabilities or refinements to the base control.

Related Controls(16)

CA-2Control Assessments (CA-2)
LMH
CP-4Contingency Plan Testing (CP-4)
LMH
MA-6Timely Maintenance (MA-6)
MH
PE-16Delivery and Removal (PE-16)
LMH
PL-2System Security and Privacy Plans (PL-2)
LMH
PM-1Information Security Program Plan (PM-1)PM-9Risk Management Strategy (PM-9)PM-30Supply Chain Risk Management Strategy (PM-30)PM-31Continuous Monitoring Strategy (PM-31)RA-7Risk Response (RA-7)
LMH
SA-8Security and Privacy Engineering Principles (SA-8)
LMH
SI-12Information Management and Retention (SI-12)
LMH
IR-4Incident Handling (IR-4)
LMH
MA-2Controlled Maintenance (MA-2)
LMH
RA-3Risk Assessment (RA-3)
LMH
SI-4System Monitoring (SI-4)
LMH

Threat Coverage(1 ATT&CK techniques)

T1195Supply Chain Compromise

Cross-Framework Mappings(23)

GV.SC-01GV.SC-01Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.SC-02GV.SC-02Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.SC-03GV.SC-03Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.SC-08GV.SC-08Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.SC-09GV.SC-09Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.SC-10GV.SC-10Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
ID.AM-04ID.AM-04Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
ID.IM-04ID.IM-04Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.RM-01GV.RM-01Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.RM-03GV.RM-03Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.RM-04GV.RM-04Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
ISO 27001ISO/IEC 27001:20224 mappingsFinal
NIST OLIR informative reference — SP 800-53 Rev 5 to ISO/IEC 27001:2022
GV.SC-01GV.SC-01Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.SC-02GV.SC-02Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.SC-03GV.SC-03Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.SC-08GV.SC-08Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.SC-09GV.SC-09Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.SC-10GV.SC-10Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
ID.AM-04ID.AM-04Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
ID.IM-04ID.IM-04Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.RM-01GV.RM-01Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.RM-03GV.RM-03Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.RM-04GV.RM-04Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5

Organization-Defined Parameters(2)

Assignmentorganization-defined systems, system components, or system services
Assignmentorganization-defined frequency

Control Enhancements(1)

SR-2(1)Establish SCRM Team (SR-2(1))
LMH

See Also

@SP 800-53 Overview⚖Compare Baselines