SR-1 Policy and procedures
The supply chain risk management policy and procedures: ownership, scope, review frequency and how this -1 control governs the SR family introduced in Rev. 5.
SR Supply chain risk management
Supply chain risk management family, new in Rev. 5: the SCRM plan, supply chain controls, provenance, acquisition strategies, supplier assessments, notification agreements, tamper protection, component authenticity and disposal.
SR-2 Supply chain risk management plan
The supply chain risk management plan: scope across the life cycle, review cycle and protection, plus the SR-2(1) enhancement that establishes a supply chain risk management team.
SR-3 Supply chain controls and processes
Supply chain controls and processes: identifying weaknesses in suppliers and processes, the controls chosen to limit supply chain harm, and FedRAMP's custody documentation expectation.
SR-4 Provenance
Provenance: records of the origin and chain of custody of components and data, with enhancements for identity, tracking and validation Not in any SP 800-53B baseline.
SR-5 Acquisition strategies, tools, and methods
Acquisition strategies, tools and methods: contract clauses, approved supplier lists and procurement practices that reduce supply chain risk. In all three security baselines.
SR-6 Supplier assessments and reviews
Supplier assessments and reviews: evaluating suppliers' security practices and the risks of what they deliver, on a defined cycle. Moderate and high baselines; FedRAMP requires it at Classes C and D only.
SR-7 Supply chain operations security
Supply chain operations security: protecting information about suppliers, components and logistics that adversaries could use to target the supply chain. Not in any SP 800-53B baseline.
SR-8 Notification agreements
Notification agreements: contract terms and procedures for suppliers to report compromises and other supply chain events. In all three security baselines.
SR-9 Tamper resistance and detection
Tamper resistance and detection: a tamper protection program across the life cycle, with the multiple-stages enhancement. High baseline only; moved here from the withdrawn SA-18.
SR-10 Inspection of systems or components
Inspection of systems or components: physical and logical inspections for tampering, for example when devices return from travel or high-risk locations. In all three security baselines.
SR-11 Component authenticity
Component authenticity: anti-counterfeit policy and procedures, reporting counterfeits, and enhancements for anti-counterfeit training and configuration control during repair. Moved here from the withdrawn SA-19.
SR-12 Component disposal
Component disposal: disposing of components, documentation and tools so supply chain information and data cannot be recovered. In all three security baselines.
