PM-30(1)

Requirement

Identify, prioritize, and assess suppliers of critical or mission-essential technologies, products, and services.

Discussion

The identification and prioritization of suppliers of critical or mission-essential technologies, products, and services is paramount to the mission/business success of organizations. The assessment of suppliers is conducted using supplier reviews (see SR-6) and supply chain risk assessment processes (see RA-3(1)). An analysis of supply chain risk can help an organization identify systems or components for which additional supply chain risk mitigations are required.

Title

Supply Chain Risk Management Strategy | Suppliers of Critical or Mission-essential Items
Family

Program Management
NIST 800-53B Baseline(s)

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Supply chain risk management strategy; organization-wide risk management strategy; enterprise risk management documents; inventory records or suppliers; assessment and prioritization documentation; critical or mission-essential technologies, products, and service documents or records; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with supply chain risk management responsibilities; organizational personnel with information security responsibilities; organizational personnel with acquisition responsibilities; organizational personnel with enterprise risk management responsibilities].

Test

[SELECT FROM: Organizational processes for identifying, prioritizing, and assessing critical or mission-essential technologies, products, and services; organizational processes for maintaining an inventory of suppliers; organizational process for associating suppliers with critical or mission-essential technologies, products, and services].

ID	Assessment Objectives
PM-30(01)[02]	suppliers of critical or mission-essential technologies, products, and services are prioritized;
PM-30(01)[03]	suppliers of critical or mission-essential technologies, products, and services are assessed.
PM-30(01)[01]	suppliers of critical or mission-essential technologies, products, and services are identified;

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!