N
|
controlSR-3

Supply Chain Controls and Processes (SR-3)

Establish a process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes of [organization-defined] in coordination with [organization-defined]; Employ the following controls to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events: [organization-defined] ; and Document the selected and implemented supply chain processes and controls in [orga

Security Baselines

LOWMODERATEHIGH
supply-chainacquisitionthird-partyrisk

Why These Connect

Maps To25

These are equivalent or closely aligned requirements in other frameworks.

Baselined In3

This control is included in the linked security baseline (LOW, MODERATE, or HIGH).

Supports44

These related controls work together — a change to one may affect the others.

Mitigates1

This control helps defend against or reduce the risk of the linked threat technique.

Enhances3

These enhancements add specific capabilities or refinements to the base control.

Related Controls(25)

CA-2Control Assessments (CA-2)
LMH
MA-2Controlled Maintenance (MA-2)
LMH
MA-6Timely Maintenance (MA-6)
MH
PE-3Physical Access Control (PE-3)
LMH
PE-16Delivery and Removal (PE-16)
LMH
PM-30Supply Chain Risk Management Strategy (PM-30)SA-2Allocation of Resources (SA-2)
LMH
SA-3System Development Life Cycle (SA-3)
LMH
SA-4Acquisition Process (SA-4)
LMH
SA-5System Documentation (SA-5)
LMH
SA-8Security and Privacy Engineering Principles (SA-8)
LMH
SA-9External System Services (SA-9)
LMH
SA-10Developer Configuration Management (SA-10)
MH
SA-15Development Process, Standards, and Tools (SA-15)
MH
SA-24Design For Cyber Resiliency (SA-24)SC-29Heterogeneity (SC-29)SC-38Operations Security (SC-38)SI-7Software, Firmware, and Information Integrity (SI-7)
MH
PL-8Security and Privacy Architectures (PL-8)
MH
SC-7Boundary Protection (SC-7)
LMH
SC-30Concealment and Misdirection (SC-30)SR-6Supplier Assessments and Reviews (SR-6)
MH
SR-9Tamper Resistance and Detection (SR-9)
H
SR-11Component Authenticity (SR-11)
LMH
SR-10Inspection of Systems or Components (SR-10)
LMH

Threat Coverage(1 ATT&CK techniques)

T1195Supply Chain Compromise

Cross-Framework Mappings(25)

GV.SC-01GV.SC-01Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.SC-02GV.SC-02Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.SC-03GV.SC-03Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.SC-05GV.SC-05Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.SC-07GV.SC-07Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.SC-08GV.SC-08Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.SC-09GV.SC-09Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.SC-10GV.SC-10Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
RS.MA-01RS.MA-01Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
RS.CO-02RS.CO-02Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
RS.CO-03RS.CO-03Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.OC-02GV.OC-02Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
ISO 27001ISO/IEC 27001:20222 mappingsFinal
NIST OLIR informative reference — SP 800-53 Rev 5 to ISO/IEC 27001:2022
GV.SC-01GV.SC-01Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.SC-02GV.SC-02Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.SC-03GV.SC-03Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.SC-05GV.SC-05Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.SC-07GV.SC-07Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.SC-08GV.SC-08Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.SC-09GV.SC-09Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.SC-10GV.SC-10Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
RS.MA-01RS.MA-01Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
RS.CO-02RS.CO-02Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
RS.CO-03RS.CO-03Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.OC-02GV.OC-02Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5

Organization-Defined Parameters(5)

Assignmentorganization-defined system or system component
Assignmentorganization-defined supply chain personnel
Assignmentorganization-defined supply chain controls
SelectionSelection (one-or-more): security and privacy plans / supply chain risk management plan / {{ insert: param, sr-03_odp.05 }}
Assignmentorganization-defined document

Control Enhancements(3)

SR-3(1)Diverse Supply Base (SR-3(1))
SR-3(2)Limitation of Harm (SR-3(2))
SR-3(3)Sub-tier Flow Down (SR-3(3))

See Also

@SP 800-53 Overview⚖Compare Baselines