SR-5 Acquisition strategies, tools, and methods: requirements and evidence

What SR-5 acquisition strategies require and why assessors start with purchasing

SR-5 asks the organization to define how it acquires systems, components and services so that supply chain risk is protected against, identified and mitigated. The organization owns this control. An implementation partner can help build the procurement practices and evidence behind it, but no outside party can accept the control on the organization's behalf. The control sits in the Supply Chain Risk Management family introduced in Revision 5, and SP 800-53B assigns it to the low, moderate and high baselines, so any system that falls under those baselines needs it. Assessors test it mostly through documents and interviews rather than technical scans: they ask to see how purchases were made, what the contracts say and whether staff know the rules.

The control is hard for predictable reasons. Purchasing records tend to sit with several teams, such as IT, finance, engineering and business units, and nobody holds a complete picture of which systems, components and services were bought and on what terms. Contracts signed before the control existed often lack security, supply chain or disclosure language, and renewals may simply carry old terms forward. Many organizations also have no written supplier criteria, so one buyer accepts a vendor that another would reject. Under SP 800-53A, the examine objects include acquisition documentation, purchase orders, acquisition contracts, training records for supply chain risk and solicitation documents, so an assessor will ask for each of these.

A practical first step is to inventory recent acquisitions of systems, components and services over a defined period, then sample several of them and check whether the purchase order, contract and solicitation reflect the criteria the organization says it uses. Confirm with your assessor which period and sample size they expect, since NIST does not set those for you. Also confirm whether your FedRAMP or customer requirement adds obligations beyond the base control, because the FedRAMP Rev5 baselines require SR-5 at Classes B, C and D.

Which acquisitions and teams fall under SR-5 scope

SR-5 has no enhancement assigned to an SP 800-53B baseline, so the work comes from the base control's defined parameter and your own acquisition scope. The decisions below set which purchases, teams and third parties the control reaches, and each one should be written down before the first procurement review.

System categorization level

SP 800-53B assigns SR-5 to the low, moderate and high baselines, so the impact level of each system decides whether the control applies at all. Confirm the categorization in the system security plan for every system that depends on purchased components or services. A system that was categorized low in an earlier cycle may need re-review if it now takes on more sensitive data or new integrations.

FedRAMP Rev5 class requirements

If you sell cloud services to federal agencies, FedRAMP's Rev5 baselines require SR-5 at Classes B, C and D. Ask your authorizing body or FedRAMP advisor which class applies to your offering and whether any agency-specific requirements add to it. The class determines how much acquisition evidence the assessor will expect.

Hardware, software and open-source components

Acquisitions include servers, network devices and endpoints, commercial software licenses, and open-source components that reach your environment through a vendor's product. Dependency inventories such as CycloneDX SBOMs help you see which third-party components entered through each purchase. Record the acquisition path for each component so the scope does not stop at direct purchases.

Cloud and managed service contracts

Cloud accounts, managed security providers, outsourced hosting and implementation partners all sign contracts that fall within the acquisition scope. Check whether the contract covers subcontractors and who holds the purchase order for each service. Consolidated enterprise agreements can hide several acquisitions under one signature, so list each service separately in the scope.

Purchasing and procurement teams

Scope covers every team that can commit funds or sign for technology, including IT, engineering, facilities and business units that buy software on corporate cards. Procurement, security and legal should each own a documented step in the approval path. Ask for the list of people authorized to issue purchase orders, since SR-5 assessment examines acquisition documentation such as purchase orders.

Third parties that sign contracts

Resellers, distributors, outsourced procurement providers and integrators can sign contracts on your behalf or deliver components you did not select directly. Confirm which third parties hold signing authority and whether their contracts carry the same acquisition clauses. For nonfederal contractors handling CUI, SP 800-171 Rev. 3 derives requirement 03.17.02 from SR-5, so the same third-party scope applies to those contracts.

How an assessor tests SR-5 under SP 800-53A

This table maps the SR-5 assessment elements in SP 800-53A Release 5.2.0 to the evidence an assessor examines, the people they interview and the common findings that cause a failed test. Confirm exact determination statement wording in the SP 800-53A text before using it in an assessment plan.

Assessment element	What the assessor does	Evidence that passes	Common finding
Determination statement 1 (acquisition strategy)	Examines whether defined acquisition strategies, contract tools and methods exist and are applied to supply chain risk	Written acquisition strategy with named risk-protection steps and records showing it was followed	Acquisitions made outside the defined strategy with no documented exception
Acquisition documentation and purchase orders	Examines acquisition documentation, including purchase orders, for security-relevant terms and approvals	Purchase records linked to a risk review that matches the strategy's approval path	Purchase orders with no record of supply chain risk review
Acquisition contracts for systems, components or services	Examines contract text for the supply chain protections the organization defined	Contract clauses covering security requirements, supplier obligations and approved sourcing	Contracts missing security terms or relying on generic boilerplate
Training and awareness documentation	Examines records of supply chain risk training for personnel involved in acquisitions	Training materials, attendance records and dated completions for procurement and requesting staff	No training records for procurement staff
Solicitation documentation	Examines requests for proposals and solicitations for supply chain security requirements	Solicitations that state supply chain requirements and evaluation criteria	Solicitations issued without security criteria for suppliers
Interview (procurement and security staff)	Interviews staff on how the strategy is applied in practice and who approves exceptions	Consistent answers that match the written process and named approvers	Staff unaware of the defined strategy or unable to name an approver
Test (sample of acquisitions)	Tests a sample of recent acquisitions against the strategy and contract clauses	Sampled acquisitions show the strategy steps and contract terms were applied	Sampled acquisitions skip steps or show undocumented approvals

Where organizations fall short on SR-5 and how to close each gap

SR-5 is assessed on evidence, not intent. The gaps below are the ones that most often leave an acquisition process unable to show that supply chain risk was considered before a purchase. Each card names one gap and a fix that an owner can assign and an assessor can test.

Contract templates lack supply chain terms

Standard purchase and services templates often cover price, delivery and liability but say nothing about supplier security obligations. Add clauses that require suppliers to disclose subcontractors, provide a software bill of materials for delivered software, and notify the buyer of security incidents affecting the product. Ask legal and procurement to confirm which template is used for each category of purchase, and sample recent contracts to check that the clauses are present. Assessors review acquisition contracts directly, so a clean template library with no supply chain language will be a finding.

Strategy exists only on paper

Many organizations have an acquisition policy that mentions supply chain risk, but buyers do not follow it when they select suppliers. Turn the policy into a short written acquisition strategy with defined steps, such as risk tiering by system impact, required security reviews above a set threshold, and named approvers. Then confirm that recent purchases went through those steps by reviewing a sample of acquisition files. The gap is closed when the file trail matches the written strategy.

Purchase orders cannot be traced to a strategy

Purchase orders often record the item, quantity and cost but not the risk tier, the security review outcome or the contract template used. Add required fields to the purchase request workflow that capture these items and link each order to its approved strategy. Ask the procurement system owner to produce a report of orders above the review threshold and check that each one carries a review reference. Without this link, an assessor cannot confirm that the strategy was applied.

No training record for procurement staff

Buyers and contract managers are often the people who decide which supplier is acceptable, yet they receive no documented training on supply chain risk. Assign a short role-based course covering the organization's acquisition strategy, the security clauses in standard contracts and how to escalate a supplier concern. Keep attendance records, completion dates and the course content, and repeat the training when the strategy changes. Assessors look for this training evidence, which is separate from general security awareness.

Organization-defined parameter left blank

SR-5 has an organization-defined parameter that the organization must fill in, and an undefined value makes the control impossible to test. Decide the acquisition strategies, the tools and the procurement methods the organization will use, and record them in the system security plan or the supply chain risk management plan. Name the owner of each value and set a review date. An assessor will compare what the organization did against what it declared, so the declared values must be specific enough to check.

Implementing an SR-5 acquisition strategy, step by step

This sequence turns SR-5 from a policy statement into acquisition practice, with each step producing a document, a template or a record that an assessor can examine against the control's determination statements.

Define the parameter and acquisition strategies
Start by setting the organization-defined parameter for SR-5 and listing the acquisition strategies, tools and methods the organization will use to protect against, identify and mitigate supply chain risk. Procurement, security and the owners of key systems should agree the list, and the parameter should reflect the systems in scope and their impact levels. Record the decisions in an approved acquisition strategy document with a named owner and an approval date. The step is complete when that document is approved and can be handed to an assessor as the basis for SR-5. Confirm the exact parameter wording against the current SP 800-53 Release 5.2.0 catalog before you finalize it.
Build the clause library and solicitation templates
Translate the approved strategies into contract clauses and solicitation templates that procurement can reuse. Typical clauses cover security expectations for suppliers, disclosure of subcontractors, software and component inventory requirements, and rights to review supplier practices. Store the clauses in a controlled library with version numbers, and map each clause to the strategy it supports. Legal counsel should review the wording, since enforceability depends on the jurisdiction and contract type. The output is a clause library and a set of solicitation templates, and the step is closed when a sample request for proposal uses them end to end.
Set approved supplier criteria and workflow
Define the criteria a supplier must meet before it appears on the approved supplier list, such as evidence of security assessments, acceptance of the clause library and a documented way to report incidents. Describe who reviews each request, what evidence is required and how exceptions are approved and time-limited. Record each supplier decision in an approval record that shows the criteria checked, the reviewer and the outcome. The step is complete when the workflow is written down and at least one supplier has been approved or declined through it with a saved record.
Train procurement and requesting staff
Train the people who write requirements, raise purchase orders and sign contracts on the strategies, clause library and approval workflow. Include requesting staff who select products, since they often start a purchase before procurement is involved. Training should explain how to recognize a purchase that needs review, which clauses are mandatory and where the approved supplier list lives. Keep attendance records, the training materials and a short assessment or sign-off for each participant. This step produces training records that support the SR-5 examine objective on training programs for supply chain risk.
Run first acquisitions and keep the records
Route the first real acquisitions through the process, from requirement through solicitation, supplier approval and contract signature. Keep every artifact in the purchase file: the requirement, the solicitation, the approval record, the executed contract with its clauses and any exception approvals. Review the first set of files against the approved strategy and note gaps as corrective actions. A sample of completed purchase files, with dates and approvers visible, is the evidence an assessor will ask to examine. Confirm with your assessor which sample size and retention period they expect before this step is closed.

Evidence that passes an SR-5 examination

An SR-5 examination looks for documents that show acquisition decisions were planned, written into contracts and carried out consistently. The six artifacts below connect policy to purchase, so an assessor can trace a single requirement from the strategy through the contract to the buy. Each one needs an owner and a review point tied to your own procurement cycle.

Documented acquisition strategy

This is the written statement of how your organization acquires systems, components and services while managing supply chain risk. It should name the risk criteria used to choose suppliers, the tools used to enforce them and the procurement methods that apply to different purchase types. Assessors check that the strategy is approved, versioned and matches what procurement staff actually do. Record the document owner, the approval date and the review date set by your own cycle, and keep the superseded versions for the audit trail.

Contract clause library and executed contracts

A clause library is a controlled set of approved supply chain terms, such as security requirements, notification duties, right-to-audit and product integrity obligations, that procurement inserts into agreements. Assessors sample executed contracts and check that the relevant clauses appear. Keep the library under version control with a named owner, and track which clauses each executed contract uses so a clause change can be matched to affected agreements. Confirm the review cadence with legal counsel.

Solicitation documentation

Solicitations, requests for proposal and bid evaluation records show that supply chain risk criteria were applied before a supplier was chosen. Assessors look for security requirements in the solicitation itself, scoring that reflects those requirements and records explaining why a supplier was selected or rejected. Store each solicitation with its evaluation worksheet and the final award decision so the chain from requirement to award is visible. Assign an owner for each solicitation template and review templates whenever the strategy changes.

Approved supplier list with approval records

An approved supplier list records which suppliers have passed your risk review and under what conditions. Each entry should link to the assessment that justified approval, the review date and any restrictions, such as limits on data types or product categories. Assessors check that purchases come from listed suppliers and that removals are recorded. Assign a single owner for the list, require a dated approval record for each change, and set a review trigger that follows your own supplier risk policy.

Purchase order samples linked to the strategy

Purchase orders are the proof that the strategy was used on real buys. Assessors usually request a sample and trace each order back to a solicitation or approved supplier, and to the contract clauses that apply. Keep a register that ties each purchase order number to its supplier, contract and risk review, so samples can be pulled quickly. Confirm with your auditor how many samples and which purchase types they will select, since that depends on the assessment plan.

Training and awareness records for procurement staff

Procurement, legal and business owners who buy technology need training on the supply chain risk criteria and the clause library. Assessors check the training content, the list of people who completed it and the dates. Records should show who was trained, on which version of the strategy and when refresher training occurred. Ask your training owner to tie course versions to strategy versions, so a reviewer can confirm that staff learned the current rules rather than an older set.

What meeting SR-5 costs in money and effort

This table breaks down the cost components of meeting SR-5 by who is paid for each task, whether the cost is one-time or recurring, and what drives it up. Use it to build a request for quote with written line items, and to decide which parts your own staff can absorb. No prices or durations are given here, so confirm rates and effort against your own environment.

Cost component	Payer and one-time or recurring	What drives it up	How to keep it down
Legal and contract drafting for clause updates	Legal counsel, one-time, with periodic revision	Number of supplier contract types, custom terms, and changes to security requirements	Maintain standard clause templates for software, hardware and services, and reuse them across contracts
Procurement process design	Internal procurement and security staff, one-time, then periodic review	Number of business units buying independently and lack of an existing acquisition workflow	Start from a documented intake form and one approval path, and review it on your own defined cycle
Supplier assessment effort tied to approved supplier lists	Internal security staff, recurring for each review cycle	Number of suppliers on the list and depth of questionnaires for each supplier tier	Tier suppliers by criticality and assess high-impact suppliers in depth, lighter checks for low-impact ones
Training for procurement and requesting staff	Internal training owner or external trainer, recurring	Staff turnover and number of people who initiate purchases outside procurement	Add a short module to existing awareness training and track completion records
Evidence upkeep, including sampling purchase files each cycle	Internal compliance staff, recurring; auditor performs its own sampling	Volume of acquisitions, missing purchase orders, and contracts stored across unlinked systems	Keep purchase orders, contracts and solicitation documents in one indexed repository linked to each system
Tooling for SBOM and component inventory where acquisitions include software	Internal platform team for setup, recurring for licenses or hosting if used	Number of software components, frequency of updates and need for license tracking	Prefer open-source tools such as Dependency-Track or Trivy where they meet your needs, and confirm supported formats before purchase
External review of contract language or external testing	Legal counsel or implementation partner, one-time or periodic	Scope of review, number of contract templates and whether testing covers acquired components	Agree a fixed written scope with the reviewer, and limit reviews to high-risk acquisition paths
Independent assessment of acquisition evidence	Independent auditor or assessor, per assessment cycle	Number of sampled acquisitions and completeness of the evidence file	Ask the assessor for its sample method in advance and prepare evidence before fieldwork

Self-hosted open-source tools that support SR-5 evidence

SR-5 asks for acquisition practices that reduce supply chain risk, and assessors look for records that show those practices were applied to what was actually bought and deployed. The three tools below produce inventory and review evidence about software components, which supports that record. None of them replaces the contract terms, supplier decisions or procurement approvals that the organization must own.

Inventory supplier software with Dependency-Track

Dependency-Track consumes and produces CycloneDX SBOMs and VEX, so software received from suppliers can be recorded as a component inventory and kept current as new releases arrive. It flags known vulnerabilities, outdated or modified components and license risk, and tracks license use by component using SPDX license IDs. For SR-5, the practical check is whether every supplied product has an SBOM on file, that the SBOM is loaded into the tool, and that someone reviews the findings before the product is accepted. Confirm that your suppliers will deliver CycloneDX documents, since the tool does not create them for proprietary products.

Verify what was received with Trivy

Trivy identifies the OS packages and software dependencies in a target and can produce them as a software bill of materials. It can also scan an existing SBOM, which is useful when a supplier delivers a bill of materials and you need to confirm it matches the artifact in your environment. Run the scan against the delivered image or package before deployment and retain the output with the acquisition record. A mismatch between the supplier's SBOM and the scanned contents is a finding to investigate, not a formality to close.

Track assessments with CISO Assistant

CISO Assistant ships more than 200 frameworks, including NIST CSF, and runs audits and compliance assessments against them with automatic mapping between frameworks. It is an assessment workflow tool, so it can hold the SR-5 assessment record and the evidence links, but it does not supply contract clauses or decide what suppliers you approve. Its AGPL-3.0-only license carries obligations, particularly if you modify and offer the software over a network, so have counsel review them before adoption.

Who owns SR-5, what a partner prepares and what the auditor decides

SR-5 asks for acquisition strategies, contract tools and procurement methods that guard against and reduce supply chain risk, so the organization must own those decisions. Procurement, legal, the security function and the owner of the supply chain risk program define what good acquisition looks like, approve the clauses that go into contracts, and decide which suppliers are approved for which kinds of systems and services. Your team also keeps the purchase records and solicitation files that an assessor will later ask to examine.

Strategy and policy: Define the acquisition strategies and the criteria that trigger extra scrutiny, such as data sensitivity or system impact.
Contract clauses: Approve security, notification, audit and training terms that go into standard and negotiated agreements.
Approved supplier lists: Own the criteria for listing, reviewing and removing suppliers, and the people who make those calls.
Purchase and solicitation records: Keep acquisition documentation, purchase orders and solicitation files in a retrievable form.
Staff awareness: Run and record supply chain risk training for buyers, requesters and approvers.

Before engaging any outside party, confirm that these owners are named in writing and that the records they produce are stored where an assessor can reach them.

Questions buyers ask about SR-5 cost, effort and outside help

How much effort does SR-5 take compared with other SR controls?

SR-5 often takes more effort than the SR controls that produce a single document, because it covers every acquisition that brings system components or services into the environment. The workload depends on how many purchases fall in scope, how consistent contract language is across business units, and whether buyers already record supply chain risk during solicitation. An organization with a supply chain risk management plan under SR-2 that defines required clauses and reviewers will usually carry less work than one buying decentrally with no standard terms. Ask any advisor to size the effort from a counted list of contracts and solicitations in scope.

Can a small organization meet SR-5 without outside help?

Yes, a small organization can often meet SR-5 internally if one accountable person owns the acquisition process and its evidence. The control asks for defined acquisition strategies, contract tools and procurement methods, and assessors look for records that show they are used, such as solicitations, contracts, purchase orders and training records. A small team can produce those from a short set of standard clauses and a checklist applied to each purchase. Outside help becomes more useful when existing contracts need review, legal capacity is thin, or nobody can say which suppliers provide system components. Independent assessors decide whether the evidence is sufficient, not the advisor who prepared it.

What does SR-5 need from procurement and legal staff?

Procurement and legal staff own most of the SR-5 evidence. Procurement keeps purchase orders, solicitations, vendor selection records and any approved supplier list, and applies the same security requirements across buying channels. Legal drafts or approves the clauses that carry security and supply chain expectations into agreements, such as terms on component origin, change notification and data handling. Security or platform teams set the technical requirements and review suppliers, but the organization remains accountable for its controls. Expect a one-time effort to build clause templates and a recurring effort to apply them at renewals and new purchases. Ask who signs off, how exceptions are approved and where the records are kept.

How long does SR-5 take to implement?

The duration depends on the number of contracts and suppliers in scope, and no duration is supplied for this control. Work moves faster when acquisition records are centralized and clause templates already exist. It slows when contracts are spread across business units or held only on paper. Renewal cycles also set the pace, because new clauses usually enter agreements at renewal or at the next purchase, which can take longer than a single project window. Ask the advisor to tie the timeline to a written list of contracts, the clauses to be added and the evidence to be produced. Confirm whether the plan assumes existing contracts will be amended or only new ones will carry the terms.

Does SR-5 apply to open-source software bought through vendors?

Yes. SR-5 concerns how an organization acquires system components and services, and that includes commercial support, managed hosting and packaged distributions of open-source software. An open-source license does not remove the vendor's obligations for what it delivers, so contracts should still state which components ship, how updates arrive and how vulnerabilities are reported. Technical evidence helps: a CycloneDX software bill of materials can document component inventory, and Trivy can produce one from a target. OWASP Dependency-Track can track known vulnerabilities and license risk using SPDX license IDs. Confirm with each vendor which of these outputs it will provide under contract.

What should a fixed-scope proposal for SR-5 readiness include?

A fixed-scope proposal should state what is in and out of scope before work starts. Ask for the list of acquisition documents, contracts and solicitations to be reviewed, the SR-5 determination statements and examine objects the work addresses, and the clause templates or checklists to be delivered. Also ask for named deliverables, the inputs your team must provide for each one, and the milestones agreed in writing. Check exclusions such as renegotiating existing contracts, legal advice or the assessment itself. DeployOpen prepares systems, controls and evidence for assessment, but only an independent auditor or assessor issues a report. The quote follows from the written scope, so the proposal should describe that scope in detail.

How DeployOpen scopes SR-5 and prepares evidence for it

DeployOpen approaches SR-5 as a scoped engagement inside your own environment. We plan, implement and document the systems and records that show how your organization acquires systems, components and services, and independent assessors decide whether the control is met.

How we scope

Written scope lists the acquisition documents, contract templates and procurement workflows in use for SR-5.
Scope defines which open-source platforms and supply chain tooling are deployed inside your own cloud, data center or air-gapped network.
Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.

How we build

We configure component inventory and SBOM tooling so acquired software is traceable to a recorded source.
We help map existing contract clauses and approved supplier lists to the SR-5 determination statements in SP 800-53A.
We test the evidence pipeline so purchase orders, contracts and solicitations can be retrieved for an assessor.

How we hand over

Deliverables include configuration records, procedures, and an evidence index keyed to each SR-5 assessment object.
You receive runbooks explaining who owns each acquisition record and how it is updated when a contract changes.
We document gaps we found and the remediation options, so your team decides what to fix and in what order.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after handover.
Retainers can cover tooling updates and refreshed evidence when acquisition policies or contract templates change.
Assessment decisions, certifications and reports remain with your organization and the independent assessor you select.