SR-6 Supplier assessments: requirements and evidence

What SR-6 supplier assessments require and why assessors check them

If your system is categorized at the moderate or high impact level, or you are pursuing a FedRAMP Class C or D authorization, or a contract cites SR-6, you need a repeatable way to assess the suppliers and contractors behind your system and to review them on a defined schedule. SR-6, Supplier Assessments and Reviews, is the base control in the Supply Chain Risk Management (SR) family of NIST SP 800-53 Rev. 5 that asks for exactly that. SP 800-53B places it in the moderate and high baselines, and FedRAMP's Rev5 baselines require it at Classes C and D.

In plain terms, SR-6 asks you to assess and review, at a frequency you define, the supply chain risks tied to your suppliers or contractors and to the systems, components or services they provide. The risk it addresses is that a supplier's weak security practices or a compromised product can enter your environment without you seeing it. What usually makes this hard is that organizations never build a complete list of suppliers that touch the system, so some are never assessed. The other common failure is an assessment done once at onboarding and never repeated, which leaves the review part of the control unmet. The organization owns these decisions: it chooses the criteria, the frequency and the risk responses. SR-6 is an assurance-related control in Appendix C of SP 800-53 Rev. 5, so assessors look for proof that the review happened and that its results were acted on, not only that a policy exists.

Assessors will ask for the supply chain risk management strategy and the records of supplier due diligence reviews, which is what SA-level examination in SP 800-53A Release 5.2.0 targets for SR-6. Before the assessment, confirm with your assessor which supplier population, review frequency and evidence format they expect, and check the current control text in the NIST SP 800-53 Rev. 5 publication. Start by building a supplier register tied to system components, then record each review's date, scope, findings and decision so the evidence can be sampled later.

Which suppliers, systems and teams SR-6 reaches

SR-6 applies differently depending on which baseline or FedRAMP class governs the system, what the supplier actually delivers, and what data the supplier can reach. The cards below cover the decisions that set the size of the assessment program and who must take part in it.

Which baseline applies

SP 800-53B assigns SR-6 to the moderate and high baselines, so a low-impact system carries no SR-6 requirement in the baseline. Confirm the impact categorization of each system before scoping suppliers, because a system categorized as moderate or high brings SR-6 in regardless of how simple its architecture looks. Record the baseline decision in the system security plan so the assessor can trace why SR-6 applies or does not apply to each system.

FedRAMP Classes C and D

FedRAMP's Rev5 baselines require SR-6 at Classes C and D, so a cloud service offering seeking those classes must evaluate suppliers on a defined cycle. Confirm with your authorizing body and the current FedRAMP rules which class applies to your offering, since the class sets whether SR-6 is a required control or a recommended practice. Keep the supplier list and review records in a form that a third-party assessor can sample during the assessment.

Software, hardware, hosting or services

The kind of product or service a supplier provides changes what the review must examine. A software vendor may need a review of its build pipeline, dependency practices and vulnerability handling, while a hardware vendor needs review of manufacturing and component origin. A hosting provider or managed service firm introduces operational access to your data and environment. Map each supplier to the category it falls into, because the category determines which evidence you request.

Suppliers that touch system data

A supplier that can read, store, process or administer system data or privileged access carries a different level of risk than one that delivers an isolated component. Ask each supplier whether its personnel, subprocessors or support channels can reach your data, credentials or administrative interfaces. Suppliers with that reach belong in the full review, and the review should cover how the supplier restricts and logs its own access. Document the data path so the review answers the question of what the supplier could affect.

Tiering narrows the full review

Tiering sorts suppliers by the criticality of what they deliver and the sensitivity of the data they reach, so that only the highest tiers receive a full security practice review on the defined cycle. Lower tiers may receive a lighter questionnaire or contract-based check. Write the tiering criteria into the supply chain risk management plan and apply them consistently, since an assessor will ask how each supplier landed in its tier. Revisit tier assignments when a supplier's role or data access changes.

Procurement, security and system owners

SR-6 work spans three groups. Procurement holds the contracts and supplier records, the security team runs the assessment and tracks findings, and the system owner accepts the residual risk of what the supplier delivers into the system. Name one accountable owner for each supplier review and record who signed off on the result. Gaps between these groups are a common reason review records fail to show that the organization acted on what it learned.

How an assessor tests SR-6 and what they ask to see

This table compares the three SP 800-53A assessment methods for SR-6 against what the assessor looks at, the evidence they request and the findings they commonly raise. Read it as a preparation checklist: each row names an object the organization must be able to produce on request, not a claim that a given tool or document passes the test.

Test method	What the assessor examines or asks	Evidence requested	Common findings
Examine: supply chain risk management strategy	Whether the strategy or plan defines how supplier assessments and reviews are scoped, who owns them and which suppliers and supplied systems, components or services are covered	Current strategy or plan showing the SR-6 scope, approval record and version history	Strategy is silent on suppliers or contractors, or describes reviews that no document assigns to an owner
Examine: records of supplier due diligence reviews	Whether reviews were performed for in-scope suppliers and whether they assessed security practices and the risks of what the supplier delivers	Completed questionnaires, evidence reviewed, risk ratings, findings and dispositions for a sample of suppliers	Reviews are generic questionnaires with no risk conclusion, or records exist for only some in-scope suppliers
Examine: review frequency defined by the organization	Whether the defined frequency appears in the documented control and matches the review schedule actually run	Review calendar, tickets or reassessment dates compared with the stated cycle	Frequency is defined as a parameter but reviews are overdue or triggered only by contract renewal
Interview: staff who run supplier reviews	How reviewers decide what to assess, how they weigh supplied products or services, and how they escalate issues they cannot resolve	Procedures used by reviewers, examples of escalations and the names of those responsible	Reviewers describe steps that differ from the written procedure or cannot explain how risk ratings are set
Interview: system and procurement owners	Whether they know when a supplier review is required, such as new suppliers, major changes or contract renewals, and who they notify	Intake or change records showing that review triggers were raised to the review owner	Business owners buy or onboard suppliers without informing the review team
Test: review process against a sample	Whether a sampled supplier review follows the documented steps from scope to recorded decision	Walkthrough of one or more reviews end to end, with the artifacts each step produced	Steps are skipped for low-spend or urgent suppliers, with no documented exception
Test: follow-up on identified risks	Whether risks found in reviews were tracked to closure, accepted by an authorized person or passed to related controls	Risk register entries, acceptance records and remediation evidence for sampled findings	Findings are recorded but never closed or accepted, and no owner signs off on residual risk

How to set up a supplier assessment program that passes SR-6

This sequence turns SR-6 into a working program: a defined review cycle, a maintained supplier inventory, risk tiers, assessment criteria, recorded reviews, and tracked findings that the organization can show an assessor.

Define the review cycle and the SR-6 parameter
Start by setting the organization-defined parameter that SR-6 leaves to you: how often supplier assessments and reviews happen. Assign an owner, usually the supply chain risk management lead or the security function with procurement, and get the frequency approved in writing by the people accountable for the SR family. Ask your assessor which frequency they expect for your baseline and how they will test that the chosen cycle is followed. The output is a documented review frequency tied to the SR-6 parameter, referenced in your supply chain risk management plan and policy.
Build and maintain the supplier inventory
Compile a register of every supplier or contractor whose products, components or services touch your systems, including cloud providers, software vendors, managed service providers and open-source component sources where you rely on a named maintainer or distributor. Record the system, component or service each supplier provides, the contract owner and the date of last review. Reconcile the inventory against accounts payable, procurement records and your asset inventory so new suppliers are not missed. The output is a current supplier inventory with an accountable owner and a documented update routine.
Tier suppliers by the risk of what they deliver
Assign each supplier a risk tier based on what it delivers and what it can reach, not only on contract value. Consider access to sensitive data, privileged access to systems, criticality to operations, and how hard the supplier would be to replace. Tiering determines how deep each assessment goes and how often it recurs. Document the tiering criteria and have the risk owner sign off on the tier for each supplier. The output is a tiered inventory and written tiering criteria that an assessor can trace from a supplier to its assessment depth.
Set the questionnaire and due diligence criteria
Define what a supplier must demonstrate at each tier. Build a questionnaire covering security governance, access controls, vulnerability handling, incident notification, secure development where software is delivered, and the supplier's own supply chain practices. For higher tiers, add evidence requests such as independent audit reports, certifications the supplier holds, penetration test summaries and the SBOM for delivered software. Set pass, conditional and fail criteria in advance so decisions are consistent. The output is a versioned questionnaire, a due diligence checklist per tier and written acceptance criteria.
Run and record each supplier assessment
Send the questionnaire, review the responses and evidence against the criteria, and interview the supplier where answers are unclear or the tier is high. Record who performed the review, the date, the evidence examined, the people interviewed and the outcome. Where a supplier delivers software, review its SBOM with a tool such as OWASP Dependency-Track, which consumes and produces CycloneDX SBOMs and VEX, or check component data produced by a scanner such as Trivy. Confirm the review is complete when every item in the checklist has a recorded result. The output is a dated assessment record per supplier that shows what was examined and by whom.
Track findings to acceptance, remediation or exit
Log every finding with its severity, the affected system or component, an owner and a target action. Each finding ends in one of three states: accepted with a documented risk decision, remediated with evidence the fix is in place, or resolved by exiting the supplier or replacing the component. Escalate findings the risk owner has not closed by the agreed date, and carry open items into the next review cycle. Confirm the step is complete when no finding is open without a recorded decision. The output is a findings register with closure evidence that supports the next assessment cycle.
Keep the program current and ready for assessment
Review the program on the cycle you set in the first step, and after significant supplier changes, incidents or contract renewals. Update the inventory, tiers and criteria, and confirm the questionnaire still reflects the requirements in your baseline. Ask your independent assessor how they will sample supplier records, since the assessment procedure for SR-6 examines records of supplier due diligence reviews. The output is a maintained program with a revision history and a set of records ready for examination.

Evidence that passes an SR-6 review

An assessor testing SR-6 looks for proof that supplier reviews were planned, performed on a defined cycle and acted on. The cards below cover the artifacts that connect those steps, and each one needs upkeep between audits, not just a one-time draft.

Supplier inventory

The inventory lists every supplier or contractor whose products, services or access touch the system, along with what each one provides and how critical it is. Assessors use it to confirm that no supplier falls outside the review cycle. Keep it current by tying entries to procurement and onboarding records, so a new supplier cannot be used without an inventory entry. Review the list on the same cycle as the reviews, and check that retired suppliers are marked as such rather than deleted.

Supply chain risk management strategy

The strategy section that covers supplier reviews states who performs them, what they examine, how often they run and how findings escalate. An assessor will check that the section names the review frequency your organization actually follows. Keep it current by revising it whenever the review process changes, and record the version and approval date so the document shows its own history.

Due diligence assessments with dates and reviewers

Each completed assessment records the supplier's security practices, the products or services reviewed, the findings and the named reviewer with a date. Assessors compare these records against the review cycle to see whether reviews happened when they were due. Keep them current by setting a reminder for each supplier's next review date and by storing questionnaire responses, certificates and contract security terms with the assessment rather than in personal folders.

Risk decisions and their approvers

When a review finds a weakness, someone must decide whether to accept the risk, require remediation, switch suppliers or restrict use. Each decision should name the approver, their authority and the rationale. Assessors look for decisions made by people with the right level of authority, not by the reviewer alone. Keep this current by logging each decision when it is made and revisiting accepted risks when the supplier's services or contract change.

Remediation tracking

Findings from supplier reviews need owners, due dates and closure evidence. An open finding with no owner is a common reason a review fails testing, because it shows the review had no effect. Keep the tracker current by linking each finding to the assessment that produced it, recording the closing evidence and reviewing overdue items at a regular meeting. Confirm with your auditor how closed items must be verified.

Records of reviews on the defined cycle

Assessors compare the dates of completed reviews with the frequency your organization defined. Gaps between review dates are the most direct evidence of a failed control. Keep this current with a calendar or ticket queue that generates a review for each supplier when its interval expires, and retain the completion records. If your review frequency changes, document the change and its effective date so the earlier records still make sense.

What meeting SR-6 costs in money and effort

This table breaks SR-6 cost into components, showing who is paid, whether each cost is one-time or recurring, what moves it, and what to request in writing. Use it to compare quotes on like-for-like scope before agreeing any fixed-scope work. No dollar figures or durations are given because none are supplied for this control.

Cost component	One-time or recurring	What drives it up or down	What to ask for in a quote
Tooling and licenses	Recurring (subscriptions) or one-time (setup)	Commercial questionnaire or risk-rating platforms charge per supplier or user. Self-hosted open-source tools such as CISO Assistant (AGPL-3.0-only) remove license spend but add hosting and administration effort.	Itemized license terms, hosting location, named support model, and the cost of any module needed for supplier records
Inventory and criteria build	One-time, then periodic refresh	Number of suppliers and systems in scope, how many components each supplier delivers, and whether SBOM data already exists. Dependency-Track and Trivy can help build component data.	Named staff hours for the supplier inventory, criteria document, and tiering method, with a dated deliverable list
Staff time on the review cycle	Recurring, on the defined frequency	Tier count, review depth per tier, and how many reviews the organization sets to run each cycle. A shorter cycle or deeper reviews raise effort.	The review frequency the organization defines, the reviewer roles, and the record each review must produce
Supplier response effort	Recurring, borne by suppliers and passed on in contracts	Questionnaire length, whether suppliers can reuse existing audit reports, and whether evidence requests repeat across customers.	Whether the contract allows suppliers to supply existing third-party reports, and the response window for requests
External review of high-tier suppliers	Per review, recurring for critical suppliers	Number of critical suppliers, depth of review (document review or on-site), and whether the firm has existing knowledge of the supplier.	Scope of each external review, deliverables, and whether findings are shared with the supplier
Assessor sampling	Per assessment cycle	Number of supplier review records the assessor samples, and the quality of the records kept. Clear, dated records typically shorten sampling.	Sample size approach, evidence list the assessor will request, and whether a pre-assessment check is included
Implementation partner preparation	One-time setup, optional recurring support	Current maturity of supplier records, number of systems to map, and whether controls are built in-house or with help.	Fixed scope, deliverables, handover documents, and whether support is a separate retainer

Which open-source tools support SR-6 evidence and where they stop

SR-6 asks for supplier assessments and reviews on a defined cycle, and the evidence behind them is spread across contracts, questionnaires, component inventories and vulnerability records. The three tools below can hold and analyze parts of that evidence, but none of them performs the supplier review itself. Confirm each capability in your own environment before you rely on it.

CISO Assistant for assessment records

CISO Assistant (AGPL-3.0-only) is a governance platform that ships more than 200 frameworks, including ISO 27001, NIST CSF, SOC 2, PCI DSS, NIS2, DORA and GDPR, and runs audits and compliance assessments against them. For SR-6, it can hold the review schedule, the supplier assessment records, the findings and the owner of each follow-up, so the cycle is visible in one place. Its automatic mapping between frameworks is a convenience, not a substitute for your own control mapping. Confirm which SR-6 content your version includes and how it handles supplier-level records. The AGPL-3.0-only license matters if you plan to modify and host it for others.

Dependency-Track for component risk

OWASP Dependency-Track (Apache-2.0) consumes and produces CycloneDX SBOMs and VEX, and identifies components with known vulnerabilities, outdated or modified components and license risk. It tracks license use by component using SPDX license IDs. For SR-6, this gives the reviewer current evidence on what a supplier delivered, which is one input to judging the risk of that product. It does not evaluate the supplier's security practices, contracts or staffing. Check that your suppliers can deliver CycloneDX SBOMs and VEX data, and decide who reviews the findings and how often.

Trivy for software inventory

Trivy (Apache-2.0) identifies the OS packages and software dependencies in a target and can produce them as a software bill of materials. It can also scan SBOMs that suppliers or build pipelines already produced. For SR-6, it helps you check what a supplier's system or image actually contains, and compare that with what the supplier declared. It sees only what is in the artifact it scans, so it cannot show a supplier's internal controls or development practices. Ask your suppliers which artifacts they will hand over, and test Trivy against a sample before you set the review cycle.

Who runs SR-6 in-house, who a partner helps with and what the auditor decides

Your organization owns SR-6 in full. The control asks you to assess and review, at a frequency you define, the supply chain risks tied to your suppliers and contractors and to the systems, components or services they provide. Someone accountable inside the organization must decide which suppliers are in scope, what risk each relationship carries, whether a residual risk is acceptable, and what happens when an assessment finds a gap. Those decisions cannot be delegated to a vendor or a consultant.

Supplier decisions: approve or reject suppliers, set conditions for onboarding, and decide whether a supplier with open findings keeps its access.
Risk acceptance: record who signs off on residual supplier risk and the date of that sign-off.
Review cycle: set the assessment frequency in your SR-6 parameter and run reviews on that cycle, including triggered reviews after a supplier breach or a change in service.
Remediation tracking: own the plan of action items raised by assessments and close them with evidence.
Common outsourcing: questionnaire drafting support and analyst time for document review are often outsourced, while the decisions stay internal.

Before you engage anyone, confirm that a named owner, a documented frequency and a sign-off path already exist in your supply chain risk management strategy.

Where SR-6 programs usually fall short and how to close each gap

Most SR-6 findings trace back to a few recurring weaknesses: the organization cannot list its suppliers, reviews are not repeated, and results do not lead to decisions or follow-up. The cards below pair each gap with the fix an assessor will expect to see in the evidence. Each fix is a practice the organization owns; an implementation partner can help prepare the records, but the organization sets the frequency and makes the risk decisions.

No supplier inventory

SR-6 reviews apply to the suppliers and contractors that provide systems, components or services. If the organization has no current list of those suppliers, it cannot show which ones were reviewed, which were skipped and why. Build the inventory from procurement records, contract registers and the system component inventory, then link each supplier to the systems or components it delivers. Ask whether every supplier that touches a system in scope appears on the list, including those bought through resellers or cloud marketplaces.

Reviews done once at onboarding

A supplier assessment completed during procurement and never revisited does not show ongoing review at a defined frequency. Suppliers change ownership, subcontractors, hosting locations and security practices, and their products pick up new vulnerabilities. Set a review trigger list (contract renewal, material change notice, reported incident, new subcontractor) alongside the periodic cycle, and file each review with its date and reviewer so the record shows the review did recur.

Assessments that skip delivered components

Some reviews evaluate the supplier's corporate security questionnaire but never examine what the supplier actually delivers. SR-6 asks about the risks of the systems, components or services provided, so the review should cover the software and hardware in the organization's environment. Pair supplier questionnaires with component evidence such as software bill of materials records and known vulnerability status. Ask the supplier which components and versions they deliver, and check that answer against the inventory.

No defined review frequency

SR-6 requires the review to happen at a defined frequency, so an undefined or informal cycle leaves an assessor with nothing to test against. The organization should set a frequency for each supplier tier, based on the criticality of what the supplier provides, and write it into the supply chain risk management plan or procedures. Confirm that the frequency is documented, approved, and that the review dates in the records match it.

Decisions without a named risk owner

A review that identifies risk but does not record who accepts, mitigates or rejects it leaves the decision unowned. Name a risk owner for each supplier or supplier tier, usually a business or system owner with authority over the service, and require their sign-off on the review outcome. Record accepted risks with an expiry date so they return for review rather than persisting by default.

Findings with no tracked closure

Assessments often generate findings such as missing security attestations, unpatched components or weak incident notification terms, and those findings disappear once the review is filed. Log each finding in the plan of action and milestones or a ticketing system with an owner, a due date and a closure check. Ask for evidence that closed findings were verified, and that open ones were escalated when they passed their due date.

What buyers ask before they bring in help for SR-6

How much effort does SR-6 take for a small supplier base?

For a small supplier base, the effort is mostly the first review of each supplier and the setup of a repeatable questionnaire and file. SR-6 asks the organization to assess and review supply chain risks from suppliers, contractors and what they deliver, at a frequency the organization defines. With a short list of suppliers, the work is manageable in-house if one person owns the register, collects evidence such as security reports, certifications offered by the supplier and contract terms, and records the decision for each supplier. Recurring effort is the periodic re-review, plus extra work when a supplier changes ownership, has an incident or changes the service it provides. Confirm the number of suppliers, the review frequency you intend to set, and the systems each supplier touches before estimating hours.

What drives the cost of SR-6 up?

Cost rises with the number of suppliers, how critical their systems or components are to your environment, how much access they hold to data, and how many review cycles run each year. Other drivers are the depth of evidence you require, the number of contract amendments needed to get security terms, and whether you must align the work with a framework such as FedRAMP. The main cost components are internal staff time from procurement, security and system owners, any tooling you buy, and external help if you engage a partner. Ask any quote to separate one-time setup of the supplier review process from recurring reviews, and to state which items are assumed to be provided by your own teams.

Can our team do SR-6 without an implementation partner?

Yes, a team can meet the intent of SR-6 without a partner if it has clear ownership, a documented review method and access to the people who manage each supplier. The control is organization-owned, so the organization decides the criteria, the frequency and the records. A partner is most useful when you need help designing the review process, collecting evidence across many suppliers, mapping results to other controls such as SR-3 and SR-5, or preparing records for an assessment. Whatever you choose, the organization must keep the records, because an independent assessor will examine them and no outside party can accept responsibility for the decisions.

How long does a first SR-6 review cycle take?

The length of a first review cycle depends on how many suppliers are in scope, how quickly suppliers respond to requests and how much internal agreement is needed on criteria. Do not rely on a generic duration. Agree the timeline, the deliverables and the responsibilities in a written scope before work starts, and ask the provider to show how each phase depends on supplier responses and internal approvals. Plan for a second cycle as well, because SR-6 requires reviews to be repeated on the frequency you define.

What does SR-6 need from procurement and system owners?

Procurement needs to supply the contract register, the supplier list, the security clauses in each agreement and the points where renewals or changes occur. System owners need to state which systems, components and services each supplier provides, what data those suppliers can reach and which of those services are critical to operations. Both groups should agree who signs off the risk decision for each supplier, how exceptions are recorded and how new suppliers are added before go-live. Without these inputs, the review will rest on assumptions, which assessors commonly challenge.

Can a partner issue an SR-6 assessment or certify our suppliers?

No. A partner such as DeployOpen can help prepare the review process, the supplier evidence and the records, but it cannot issue an assessment report, attestation or certification. Only an independent assessor or certification body can assess the control and report on it. Your organization remains responsible for its supplier decisions. Ask any provider to state this boundary in writing, and ask your assessor which evidence they expect to see before the work begins.

How do FedRAMP Class C and D differ from moderate baselines for SR-6?

SP 800-53B assigns SR-6 to the moderate and high baselines, so an organization working to a moderate or high baseline has the control in scope. FedRAMP's Rev5 baselines require SR-6 at Classes C and D, which means that, for a cloud service seeking those classes, the control is mandatory and assessed under FedRAMP's rules. In practice, the core work is the same, but FedRAMP expects the review to be documented in the form its rules define and to be reflected in the security package. Confirm with your authorizing body or FedRAMP assessor which class applies to your service and which evidence format they expect, since the rules are the authority, not this summary.

How DeployOpen scopes and prepares SR-6 evidence

DeployOpen helps organizations set up the supplier assessment and review records that SR-6 asks for, inside their own infrastructure. The organization still owns its supplier decisions and control results, and an independent assessor judges whether the evidence meets the control.

How we scope

Engagements are fixed-scope, with the SR-6 review cycle, supplier population and systems in scope agreed in writing first
The written scope names which supplier-delivered systems, components and services the assessment records will cover
Scope also states which evidence sources are in place and which the client must supply before work starts

How we build

We configure self-hosted tooling such as Dependency-Track for component and license records tied to supplier deliveries
We set up review workflows and templates that capture supplier security practice reviews on the agreed frequency
We map SR-6 assessment records to related controls such as SR-3 and SR-5 so reviewers can trace each finding

How we hand over

Handover includes the supplier assessment procedure, review templates and a dated record of completed reviews
Documentation explains who in the organization owns each review, approval and remediation decision
Evidence packages are organized to match the examine items an independent assessor will request under SP 800-53A

How we support

Ongoing support, upgrades and continuous testing are available as retainers after handover
Retainers can cover refreshing SBOM inputs and review records as suppliers and deliveries change
Support can help the organization prepare for its own assessor or auditor, which DeployOpen does not replace