What SR-3 supply chain controls and processes requires in plain words
When an auditor, a FedRAMP assessor or a customer's supplier questionnaire asks about SR-3, they want to see that your organization has a working process for finding weaknesses in its suppliers and its own supply chain processes, a set of defined controls that limit the harm when a supply chain event happens, and written records of both. SR-3 is the base control in the Supply Chain Risk Management family of NIST SP 800-53 Rev. 5 that asks for exactly those three things. The control does not ask you to eliminate supply chain risk. It asks you to identify it, choose controls for it deliberately and document what you chose. The organization owns the decisions. An implementation partner can help build the processes and gather the records, but it cannot certify that they work. The first part is identification. You need a defined way to find weaknesses in the elements of your supply chain, meaning the suppliers, the components they deliver and the processes that bring those components into your systems. The control requires this work to be done in coordination with supply chain personnel you have formally defined, so the people responsible must be named, not implied. The second part is control selection. Once weaknesses are identified, you choose defined controls that limit harm from supply chain events, such as contract terms, approved supplier lists, verification steps or component checks. The third part is documentation. The processes you run and the controls you select must be written down, and an assessor will test whether the written record matches what people actually do. SR-3 is hard in practice because ownership is split. Procurement holds the contracts, engineering holds the build pipeline and the software inventory, and security holds the risk register, and none of the three usually owns the whole chain. Evidence ends up scattered across purchase orders, repository settings, vendor emails and tickets. Start by naming one accountable owner and a list of the people who coordinate with that owner, then map where each piece of supplier and component evidence currently lives. The gaps you find in that map are usually the first findings an assessor would write.
Which suppliers, components and processes SR-3 reaches in your system
SR-3 has no fixed boundary. The scope you draw decides which suppliers, components and processes must be identified, controlled and documented. The cards below cover the scoping choices that change the work most, from what counts as a supply chain element to how the baseline and FedRAMP class change the depth.
Software dependencies and build tooling
Open-source libraries, container base images and CI/CD tooling are usually the largest supply chain element in a self-hosted platform. Decide whether build tools, package mirrors and signing keys sit inside the boundary. Each in-scope dependency needs a recorded origin and a process to find weaknesses. Expect the inventory to grow with every upgrade, so scope the tooling that generates it, not only a one-time list. Confirm with your assessor whether build systems count as system components or as supporting infrastructure.
Hardware and replacement devices
Servers, network appliances, storage and their spares are supply chain elements when they enter the authorization boundary. FedRAMP guidance for SR-3 expects custody documentation covering replacement devices, so spares held in storage count as well. Decide which hardware categories are inside the boundary and who receives shipments. A small number of devices with documented custody is far less effort than a fleet bought through many resellers.
Cloud services and managed providers
Cloud platforms, managed databases, managed Kubernetes and outsourced operations each add a supplier whose processes you depend on. Decide whether the provider is treated as a supply chain element, an external service under SA controls, or both. Each provider adds an identified weakness to examine and a control to document. Confirm which provider controls you inherit and which you must document yourself, because inherited evidence reduces the work only where the provider supplies it in writing.
Defined supply chain personnel
SR-3 requires coordination with defined supply chain personnel, so you must name a role or team that owns the work. Typically this sits with procurement, platform engineering, security operations or a supply chain risk group, depending on where acquisition decisions are made. Decide who approves new suppliers, who reviews dependency findings and who holds the custody records. Splitting these duties across several teams increases coordination effort and the number of handoffs an assessor will test.
Baseline and FedRAMP class depth
SP 800-53B assigns SR-3 to the low, moderate and high baselines, and none of its three enhancements is in a baseline. FedRAMP requires SR-3 at Classes B, C and D. Your system impact level sets how many suppliers, processes and records an assessor will sample. A low-impact system with a short list of suppliers needs a lighter process than a high-impact system whose supply chain spans many components. Ask your assessor to confirm the depth expected at your level before you define the scope.
Custody and integrity checkpoints
Custody covers the path a component takes from supplier to deployment, including shipping, storage and installation. Define the checkpoints where you verify that a device or artifact is what the supplier shipped, such as receiving inspection, hash comparison or signature verification. Scope these checkpoints to the components that enter the boundary, not to every item in the organization. Record each checkpoint so an assessor can trace a specific device from purchase order to installation.
How an assessor tests SR-3 and which evidence passes
This table maps each SP 800-53A assessment element for SR-3 to the method an assessor uses, the people they interview, the evidence they request and the findings that commonly cause a gap. Read it as a checklist of what to have ready before an assessment begins.
| Assessment element | What the assessor does | Evidence that passes | Common finding |
|---|---|---|---|
| Determination statement 1: processes to identify and address weaknesses | Examines the supply chain risk management strategy and interviews the personnel who run supplier reviews | Documented process for finding weaknesses in suppliers and internal supply chain steps, with records showing it was run | Process exists on paper but no record shows weaknesses were identified or addressed |
| Determination statement 2: coordination with defined supply chain personnel | Interviews named supply chain roles and checks that responsibilities match the strategy | Role assignments and meeting or ticket records showing coordination between security, procurement and engineering | Personnel named in the strategy have left the organization or never received the role |
| Determination statement 3: controls that limit harm from supply chain events | Examines selected controls against the organization-defined parameters and tests a sample | Documented controls with parameter values filled in, plus test results or operating records | Parameters left as template placeholders, so the organization has not defined them |
| Determination statement 4: documentation of selected processes and controls | Examines the strategy, acquisition documentation and acquisition contracts, then tests whether they agree | Current strategy, approved acquisition documents and signed contracts that reference the same controls | Inventory of critical components does not match purchase orders or contract line items |
| Examine: systems and critical system components inventory | Compares the inventory against acquisition records and sampled devices or software | Inventory listing components, versions, owners and sources, traceable to purchase orders | Components in use that appear in no acquisition record, or the reverse |
| Examine: acquisition documentation including purchase orders | Traces a sample of components from purchase order to receipt to inventory entry | Purchase orders and receiving records that name the supplier and the item | Purchase orders name a reseller while the inventory records a different origin |
| Interview: supply chain, procurement and system owners | Asks how components are selected, received, tracked and retired | Consistent answers that match the written process and the records | Staff describe a process that differs from the documented one |
| Test: sampled components and processes | Tests a sample of recent acquisitions against the documented controls | Walkthrough results and samples showing the controls operated during the review period | Controls documented but not applied to recent acquisitions |
What FedRAMP's custody documentation expectation means for hardware and replacement devices
For FedRAMP authorizations, SR-3 is more than a policy statement. FedRAMP guidance expects providers to document and maintain supply chain custody, including for replacement devices, so that device integrity is established before a device enters the authorization boundary. The Rev5 baselines require SR-3 at Classes B, C and D, which means a cloud service provider cannot treat custody as an informal procurement habit. The organization owns this control, and an independent assessor will ask to see the records that show it.
The practical output is a chain-of-custody record for each device or replacement part. For each item, keep a dated entry that names who received it, the source it came from (manufacturer, distributor or reseller), the checks performed on arrival (such as seal inspection, serial number and firmware verification against vendor documentation, and comparison with the purchase order), and where it was stored until installation. Each handoff between people or locations should add a new entry rather than overwrite the last one. Where a self-hosted platform manages inventory, the asset register can hold these fields, but the custody events themselves still need a human or system record that an assessor can trace back to the acquisition documentation.
Before building this record, confirm the exact expectations with your FedRAMP assessor and sponsoring agency or authorizing body. Ask which device types they consider in scope, what evidence format they accept, how far back the records must go for replacement hardware, and whether custody checks must be repeated after repairs or returns. Treat the answers as the acceptance criteria for the custody procedure. DeployOpen can help prepare the procedure, asset records and evidence for these checks, but the provider remains responsible for the custody process and the independent assessor decides whether it meets the requirement.
How to implement SR-3 in the order an assessor expects
This sequence moves an organization from named supply chain roles and an SR policy to a documented set of supply chain controls, each tied to a weakness it limits and to the records an assessor will sample. Each step produces an artifact that the next step depends on.
Confirm supply chain roles and the SR policy
Start by naming the people who own supply chain risk: the supply chain personnel that SR-3 says must coordinate on weaknesses, plus the owners of procurement, engineering, operations and security. Confirm that the SR family policy and procedures (SR-1) assign these roles, define the scope of systems and suppliers covered, and state who approves changes. The output is a short roles and responsibilities record signed by the accountable executive, plus a policy version your assessor can read. Confirm the policy and role assignments in your own governance documents, since the exact organization-defined parameters are yours to set.
Inventory supply chain elements and processes
Build a scoped inventory of the supply chain elements that matter for the system: hardware and software components, open-source dependencies, cloud and managed service providers, logistics and maintenance channels, and the internal processes that acquire, build, deploy and retire them. Tie each element to the systems and critical components it supports, using the same inventory your configuration management records use where possible. The output is a scoped inventory with an owner and a source for each entry. An assessor will compare this inventory against acquisition documentation, so gaps here propagate through the rest of the work.
Identify weaknesses with a defined method
Choose a documented method for finding weaknesses in each inventoried element and process, such as supplier questionnaires, review of contract terms, dependency analysis, or threat modeling of the delivery path. Apply it to every entry in the inventory and record the result as a weakness register: one row per weakness, with the element affected, the source of the finding, its likelihood and impact as your method defines them, and a status. The method itself should be written down so that an assessor can see that identification was systematic rather than ad hoc. Confirm the method against your own risk management process before you use it.
Select and document controls that limit harm
For each weakness that needs treatment, select a control that limits harm from a supply chain event, and record the choice in a control register. Each row should link a weakness to its control, state the control's objective, and name the parameters you defined for SR-3. Where a weakness is better addressed by a related SR control, such as acquisition strategies, supplier assessments or notification agreements, cross-reference that control rather than duplicating it. The output is a control register that an assessor can trace from weakness to control to evidence. Confirm the final control list with the owners who must operate it.
Assign owners and set review cycles
Assign a named owner to every control in the register and set a review cycle for each control and for the weakness register as a whole. Record who reviews, what triggers an out-of-cycle review (such as a supplier incident or a change in a critical component), and where the review result is stored. Ownership should match the roles confirmed in the first step. The output is the owner and review schedule attached to the control register. Confirm the cycle lengths against the requirements in your own program documents, since this page does not set them.
Collect the first set of records
Gather the initial evidence that shows the processes and controls operate: a signed acquisition record set for recent purchases of in-scope components, the completed weakness and control registers with dates and approvals, supplier documentation tied to the controls, and the inventory with its change history. Match each record to the SR-3 determination statements and to the examine objects named in SP 800-53A, such as the supply chain risk management strategy, the system inventory, purchase orders and acquisition contracts. Mark any gaps in a plan of action and milestones. The output is an evidence index that lets an independent assessor test the control without asking for documents that were never created.
Evidence that passes SR-3 and open-source tools that produce it
SR-3 is tested by examining documents: the supply chain risk management strategy, inventories, acquisition records and contracts. The cards below cover the artifacts an assessor is likely to ask for, how to keep each one current between assessments, and where self-hosted tools can generate supporting data. The organization must confirm that any tool suits its own environment, and the tools produce evidence only, not assessment results.
Supply chain risk management strategy
This is the document the assessor examines first. It should state the organization's supply chain risk management strategy, name the roles that own it, and explain how weaknesses in suppliers and processes are identified and handled. Map each defined control that limits supply chain harm back to this strategy so the selected processes and controls are documented. Check that the strategy names a review cycle and that the last review date is recorded. Confirm the wording against your own SR-2 plan so the two documents do not contradict each other.
Component and system inventory
The inventory of systems and critical system components shows what the strategy protects. For SR-3, assessors look for components named with enough detail to trace them to suppliers and acquisitions. Software inventories are most useful when they are generated from build or deployment records rather than typed by hand. Keep the inventory tied to change records so new or replaced components appear within the same review cycle. Confirm with your asset team which sources feed the inventory and who signs off on it.
Software bill of materials records
An SBOM lists the components inside a software product or deployed image, including versions and licenses, which supports the component inventory. OWASP Dependency-Track (Apache-2.0) consumes and produces CycloneDX SBOMs and VEX, flags components with known vulnerabilities, outdated or modified components and license risk, and tracks license use by SPDX license ID. Trivy (Apache-2.0) identifies OS packages and software dependencies and can produce an SBOM or scan an existing one. Store each generated SBOM with its build date so the record can be compared over time. Confirm that both tools fit your build pipeline and registries before adopting them.
Acquisition documents and purchase orders
Acquisition documentation, including purchase orders, shows how a system or service entered the environment. Assessors use it to test whether the supply chain risk management strategy reached actual procurement decisions. Each record should identify the supplier, the component or service, and the risk review completed before purchase. Keep a register that links each purchase order to its supplier review. Confirm with procurement which purchases route through security review, because low-value or self-service purchases are often missed.
Acquisition contracts
Acquisition contracts for systems or services are the agreements that set supplier obligations. For SR-3, the assessor checks that contracts carry the supply chain requirements the organization defined, such as security expectations and information about component origin. Contracts that predate the strategy usually need an amendment or a documented exception. Track which active contracts contain the required clauses and which need remediation. Confirm the clause set with legal counsel, since contract language is an organizational decision rather than something a tool can determine.
Weakness identification and custody records
The weakness identification record shows how the organization found and addressed supply chain weaknesses, and the custody records show that devices were handled under documented control. FedRAMP guidance for SR-3 expects providers to document and maintain supply chain custody, including for replacement devices, so device integrity is assured before devices enter the authorization boundary. Record each custody transfer from receipt through installation, with the person responsible at each step. Confirm your custody log format with your assessor before the next assessment, since FedRAMP expectations apply only where the program is in scope.
What meeting SR-3 costs in money and effort
This table breaks the cost of meeting SR-3 into its components, showing who is paid for each, whether it is one-time or recurring, and what pushes it up or down. Use it to build a written scope and to see where self-hosted open-source tools remove license spend. No dollar figures or durations are given because none are supplied; the rows say what to request in a quote.
| Cost component | Who is paid, and for what | One-time or recurring, and main drivers |
|---|---|---|
| Tooling and licenses | Software vendors for SBOM analysis, inventory and scanning tools; open-source tools carry no license fee | Recurring for commercial subscriptions, scaled by device, component and supplier counts; ask whether pricing is per asset or per seat |
| Engineering time for inventories and SBOMs | Internal engineers or an implementation partner to build component inventories and generate SBOMs | One-time for initial inventory, then recurring upkeep; driven by number of devices and system components in the boundary |
| Procurement and legal time for acquisition records | Procurement staff and counsel to document acquisition strategy, purchase orders and contract clauses | Largely one-time per contract template, recurring per new supplier; lower where procurement records already exist |
| Evidence upkeep | Control owners who keep supply chain custody records, supplier lists and documentation current | Recurring; rises with supplier churn, replacement devices and the FedRAMP class that sets the required scope |
| External testing or review | Independent assessors or security testing providers who examine supply chain documentation and sample evidence | Periodic; scope set by the FedRAMP class (B, C or D) and by how much of the supply chain the assessor samples |
| Auditor sampling | The independent assessor or auditor, who samples acquisition files, inventories and custody records during assessment | Recurring at each assessment cycle; fewer samples are needed when records are complete and consistently formatted |
Who does what for SR-3: your team, an implementation partner and the auditor
Your organization owns SR-3. The control asks you to identify and address weaknesses in supply chain elements and processes, to define the controls that limit harm from supply chain events, and to document both. Those decisions belong to people who can accept supplier risk on behalf of the business, so they cannot be delegated to a consultant or a tool. Your team also keeps the supplier relationships, negotiates the terms that give you visibility, and signs off on what the selected controls are.
- Named supply chain personnel: Assign owners for supply chain risk, supplier relationships and component acceptance, and record them in the risk management strategy that the assessor will examine.
- Control selection decisions: Decide which limits apply to which suppliers and systems, and record the rationale so the choice can be defended.
- Supplier contact and contracts: Hold the relationships and the agreements that let you obtain information from suppliers when weaknesses appear.
- Acceptance of residual risk: Approve or reject exceptions in writing, with a named approver.
- Ongoing operation: Review inventories and weakness findings on a defined cycle and act on them.
Before any engagement starts, confirm which of these owners already exist, because an assessor will ask for their names and records first.
An implementation partner prepares the systems, records and evidence that let your team run SR-3 and let an assessor test it. DeployOpen works in this role: it plans, builds and documents self-hosted open-source tooling inside your own environment, and it does not issue reports or conclusions. Work is normally fixed-scope, with deliverables and timelines agreed in writing before it starts, and it can include a structured weakness identification exercise across suppliers and processes.
- Component inventory and SBOM work: Produce and maintain software bills of materials, using tools such as Trivy to identify OS packages and dependencies, and feed them into a platform such as OWASP Dependency-Track.
- Record templates: Draft the supply chain risk management strategy structure, acquisition documentation templates and custody records so your team fills them in rather than starting from blank pages.
- Weakness identification support: Run the analysis of suppliers and processes that your team then reviews and approves.
- Evidence set: Assemble the artifacts an examiner will request, such as inventory exports, dependency reports and contract clause references, mapped to SR-3's examine objects.
- Operational handover: Document how the tooling is run, backed up and upgraded so the evidence stays current after the engagement ends.
The partner should never write the conclusion that the control is satisfied, and any proposal that promises a pass should be treated with caution.
The independent auditor or assessor tests SR-3 and issues the report or assessment result. The assessment procedure in SP 800-53A examines documents, interviews personnel and, where applicable, tests mechanisms. Because the assessor relies on the evidence and on its own judgment, the assessor's conclusion has to come from its own work. Under FedRAMP, the requirement for custody documentation, including for replacement devices, is also something the assessor will check directly.
- Examine objects: Expect requests for the supply chain risk management strategy, the inventory of systems and critical components, acquisition documentation including purchase orders, and acquisition contracts.
- Interviews: Expect the assessor to speak with the named supply chain personnel, not only with the partner who built the tooling.
- Independence: The assessor must not have designed the controls it tests, and the partner's role should be documented so the boundary is visible.
- Sampling and testing: Expect sample selections from suppliers, purchase orders and components, chosen by the assessor.
- Report ownership: Only the assessor's report or result states whether SR-3 is met.
Ask the assessor, before contracting, how it will document the boundary between its work and any readiness support you have purchased.
Organizations commonly outsource the parts of SR-3 that require tooling, specialist analysis and document production. They usually keep the parts that require accountability and supplier relationships. The split matters for cost, because outsourced work is one-time or recurring depending on the scope, and internal staff time for owning decisions recurs for as long as the program runs.
- Commonly outsourced: SBOM generation, dependency tooling setup, weakness analysis, template drafting and evidence collation.
- Usually kept internal: Control selection, supplier negotiation, risk acceptance, and personnel roles.
- Recurring costs: Maintaining inventories, reviewing new suppliers and running tools after handover. These depend on how often your supplier base and software change.
- Cost drivers: The number of systems in scope, the number of suppliers, how much of your software is third-party, and whether your records already exist.
- What to ask for in a quote: A written list of deliverables, the systems and suppliers in scope, the handover items, and an explicit statement that the partner does not issue the assessment conclusion.
Before signing, confirm with your assessor which artifacts it will accept from the partner and which must come directly from your own records.
Where SR-3 programs usually fall short and how to close each gap
SR-3 programs tend to fail in the handoffs between people, records and time: who owns supply chain decisions, what the inventory actually contains, and whether controls trace back to a known weakness. The cards below pair each common gap with a practical fix and the evidence an assessor would expect to see once it is closed.
No defined supply chain personnel
SR-3 requires coordination with defined supply chain personnel, so an organization must name the roles, not just the department, that identify weaknesses and select controls. Without named owners, findings from supplier reviews or vulnerability data go nowhere. Check that each role has a written responsibility, a backup, and a standing meeting or queue where supply chain findings are decided. Evidence that closes the gap is a role assignment record, a charter for the supply chain working group, and meeting minutes showing decisions taken.
Inventory that omits cloud and managed services
Assessors compare the component inventory against acquisition records, so an inventory that lists on-premises hardware but skips SaaS tenants, managed services and open-source dependencies leaves SR-3 weaknesses unidentified by design. Build the inventory from cloud account exports, contract registers and software composition output, then reconcile the three. Dependency data can be produced as a CycloneDX SBOM and tracked in OWASP Dependency-Track, which gives a searchable record of components. Evidence is the reconciled inventory with a dated reconciliation log.
Controls chosen without a documented weakness
SR-3 asks for controls that limit harm from supply chain events, and an assessor will ask which weakness each control addresses. Controls picked from a generic list, with no link to an identified weakness, are hard to defend even when they are sound. Create a register that maps each identified weakness to the chosen control, its owner and the residual risk accepted. Evidence is that register, plus the risk decision records that approved the residual risk.
Replacement devices without custody records
FedRAMP guidance for SR-3 expects providers to document and maintain supply chain custody, including for replacement devices, so integrity is assured before a device enters the authorization boundary. Replacement hardware is often ordered outside the normal procurement path and receives no custody check. Require a chain-of-custody form for every replacement device, verify the device against the vendor record before installation, and log the entry into the boundary. Evidence is the signed custody record for each device and the boundary entry log.
Acquisition records that do not match inventory
SR-3 assessments examine acquisition documentation, including purchase orders and contracts, against the system and component inventory. A purchase order for a server that never appears in the inventory is an assessor finding waiting to happen. Match each acquisition record to an inventory entry using a shared identifier such as serial number, license key or contract ID, and review mismatches each quarter. Evidence is the matched acquisition-to-inventory table with exceptions and their resolution dates.
Supplier reviews performed once
A supply chain review completed at onboarding and never repeated stops reflecting the supplier's changed ownership, subprocessors and vulnerabilities. SR-3 expects processes that keep working over time, so define a review cycle and triggers such as contract renewal, a reported incident or a new subprocessor. Track each open finding to closure. Evidence is the review schedule, dated review records and the findings log showing follow-up.
Questions buyers ask about SR-3 cost, effort and outside help
How much effort does SR-3 take to implement?
Effort depends mainly on how many suppliers, components and acquisition paths your systems use. SR-3 asks for three things: processes that identify and address weaknesses in supply chain elements and processes, defined controls that limit harm from supply chain events, and documentation of both. Most of the work is inventory and documentation, and new technology is a smaller part. Effort rises with the number of suppliers, the frequency of hardware refreshes and how many systems share the same components. The first pass builds the process and documentation, and later effort is recurring review as suppliers and components change. Ask any provider to break its estimate into inventory, process design, documentation and evidence collection so you can compare like with like.
Can our team meet SR-3 without hiring a consultant?
A capable internal team can meet SR-3, but the control touches procurement, engineering, security and legal, so one owner must coordinate all four. Outside help is most useful when the team lacks time, has no inventory of critical components, or needs help building evidence that an independent assessor will accept. The organization owns its controls and makes the decisions. An implementation partner such as DeployOpen can prepare systems, documentation and evidence under a written scope, but only an independent auditor, assessor or certification body issues reports or certificates. Before deciding, test whether your team can answer three questions: which suppliers and components are critical, who approves a new supplier, and where acquisition documents are stored. Gaps in those answers show the work ahead.
What does SR-3 need from procurement and engineering?
SR-3 depends on both functions producing records that show where components came from and how they were approved. Procurement typically supplies the material that an assessor reads first:
How long does SR-3 take to implement?
The duration depends on scope: how many systems and suppliers fall inside the boundary, how many component classes are involved, and how much inventory already exists. NIST states that it does not set federal implementation timelines, leaving that to OMB Circular A-130 and agency direction, so no NIST date settles your schedule. Your contract, regulator or assessment window sets the real target, so confirm the required completion date before scoping. Ask for milestones in the written scope, such as inventory completion, process design, documentation review and an evidence walkthrough with your assessor. A fixed-scope agreement makes these milestones checkable.
Does an SBOM tool like Dependency-Track satisfy SR-3 on its own?
No single tool satisfies SR-3 on its own. OWASP Dependency-Track consumes and produces CycloneDX SBOMs and VEX, identifies components with known vulnerabilities, outdated or modified components and license risk, and tracks license use by SPDX identifier. Trivy can identify OS packages and software dependencies and produce them as an SBOM. Those outputs help with component knowledge, which supports the inventory part of SR-3. They do not cover supplier assessments, acquisition terms, notification agreements, custody records or the documented controls that limit harm from supply chain events. Treat SBOM tooling as one source of evidence within a documented process, and confirm with your assessor which records they expect.
Does FedRAMP's supply chain custody expectation apply outside FedRAMP?
FedRAMP guidance for SR-3 requires cloud providers to document and maintain supply chain custody, including for replacement devices, so device integrity is assured before devices enter the authorization boundary. That requirement binds FedRAMP authorized providers. Outside FedRAMP, it applies only where a contract, regulator or framework you follow imports it. NIST SP 800-171 Rev. 3 derives requirement 03.17.03 from SR-3, so a defense contractor or other CUI holder may face a related expectation. Confirm with the contracting authority which custody records it requires. Even when no external rule applies, a documented custody record is a sensible way to show that your own SR-3 processes work.
What will an auditor ask for to test SR-3?
An assessor tests SR-3 through four determination statements, using examine, interview and test methods. Expect requests for the supply chain risk management strategy, inventory documentation for systems and critical components, acquisition documentation including purchase orders, and acquisition contracts for systems or services. Assessors also interview the people who run supplier selection, receiving and component replacement, then check that their practice matches the written process. Prepare a traceable chain from each documented control to a dated record, and keep the records current. The independent assessor decides whether the evidence is sufficient and issues the report. Your implementation partner can prepare that evidence, but it cannot issue the assessment result.
How DeployOpen scopes and prepares SR-3 evidence
DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure, and prepares the supply chain processes, records and evidence that SR-3 asks you to show. The organization owns its controls, and only an independent assessor issues assessment results.
How we scope
- We agree a written scope listing the systems, suppliers and supply chain elements covered by your SR-3 processes.
- Scope names the custody documentation, including replacement devices, that your assessor will expect to see.
- Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.
How we build
- We map the supply chain processes you choose to the SR-3 determination statements and their examine objects.
- We configure SBOM generation and vulnerability tracking, such as Dependency-Track and Trivy, to record component inventories.
- We test that inventories, acquisition records and weakness reviews are produced consistently before handover.
How we hand over
- You receive documented processes, configuration records and evidence samples mapped to each SR-3 determination statement.
- Documentation covers who performs each review, how often, and where the records are stored for the assessor.
- Your team owns the controls and sign-off, and an independent assessor reviews the evidence and issues any findings.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover.
- We can update SBOM and supplier records when your suppliers, components or FedRAMP requirements change.
- Confirm with your assessor which retainer tasks they expect to see reflected in your SR-3 evidence.
