CIP-013-2: the supply chain cyber security risk management plan for procuring high and medium impact BES Cyber Systems and their EACMS and PACS, its implementation, and its 15-month review.
The documented plan covering how procurement planning identifies vendor risk and which six vendor-related controls (incident notification, access revocation notice, vulnerability disclosure, software integrity, remote access coordination) procurements must address.
Showing the supply chain plan was actually used in procurements, and the limits of the requirement: no contract renegotiation and no auditing of contract terms or vendor performance.
Reviewing the supply chain risk management plan and getting CIP Senior Manager or delegate approval at least once every 15 calendar months.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.