Supply Chain Risk Management Procedure

Approval #

Revision History #

Review cycle: Every year, under the Policy and Procedure Management Policy.

1. Purpose #

The people named in this procedure use it to carry out the SR control family policy (POL-SR). It covers every control in the supply chain risk management family. The steps, the people responsible, and the evidence below show how the Organization meets those National Institute of Standards and Technology (NIST) SP 800-53 Rev. 5 controls. They also support the Inspector General (IG) Federal Information Security Modernization Act (FISMA) reporting metrics.

This general procedure covers every control in the SR family. A system that departs from it, or adds to it, has its own system-specific procedure for those controls.

2. Scope #

This procedure applies to every information system that the Organization operates, or that others operate for it, under the high security baseline.

2.1 CSF 2.0 Alignment #

The steps in this procedure support these NIST Cybersecurity Framework (CSF) 2.0 categories:

• GV.RM — Risk Management Strategy (Govern function)
• GV.SC — Cybersecurity Supply Chain Risk Management (Govern function)

3. Controls Covered #

This procedure covers the following 14 controls in the SR family:

3.1 Derived Governance Requirements #

The requirements below come from federal governance sources and apply to the SR control family. They add to the NIST SP 800-53 control requirements that the Procedure section carries out.

Executive Order 14028: Improving the Nation’s Cybersecurity

• The organization must secure the software supply chain through secure development practices, a software inventory, and producer assurance evidence matched to product risk, as OMB M-26-05 directs. (EO 14028, §4; OMB M-26-05)

CISA/NSA/FBI 2026 Minimum Elements for a Software Bill of Materials (SBOM)

• The organization must require software suppliers to provide SBOMs that satisfy the 2026 SBOM Minimum Elements, including the required data fields (component name, version, supplier, unique identifiers, component hash, dependency relationships, SBOM author, timestamp) so component provenance and supply chain risk can be evaluated. (CISA 2026 SBOM Minimum Elements, Data Fields)
• The organization must address SBOM practices and processes explicitly in any policy, contract, or arrangement to request or provide SBOMs — including frequency of SBOM updates, depth of dependency coverage, handling of known-unknowns, and distribution and access expectations. (CISA 2026 SBOM Minimum Elements, Practices and Processes)

OMB M-26-05: Adopting a Risk-based Approach to Software and Hardware Security

• The organization must decide the assurance evidence required of a producer by the risk of the product and its use — for example secure development evidence aligned to NIST SP 800-218, and a software bill of materials on request (for cloud platforms, an SBOM of the runtime production environment) — and record the assurance determination with the inventory entry. (OMB M-26-05, footnote 1 and referenced resources)

NIST SP 800-161 Rev 1: Cybersecurity Supply Chain Risk Management Practices

• The organization must operate a cybersecurity supply chain risk management program that identifies, assesses, and mitigates supplier and product risk across the acquisition lifecycle, with C-SCRM plans at the enterprise, mission, and system levels. (NIST SP 800-161 Rev 1)

FAR 52.204-30: Federal Acquisition Supply Chain Security Act Orders — Prohibition

• The organization must apply Federal Acquisition Security Council exclusion and removal orders as written: do not acquire or use a covered article an order names; require contractors, through Federal Acquisition Regulation (FAR) clause 52.204-30, to check the System for Award Management (SAM) FASCSA order list at SAM.gov at least every 3 months, to report within 3 business days of identifying a covered article subject to an order, and to submit a removal report within 10 business days; and reconcile each new order against the organization’s own software and hardware inventory. Deadline: Contractor SAM.gov check at least every 3 months; report within 3 business days and removal report within 10 business days of an order. (FAR 52.204-30; FAR 52.204-29; 41 CFR Part 201-1)

FAR 52.204-25: Prohibition on Certain Telecommunications and Video Surveillance Services or Equipment (Section 889)

• The organization must exclude covered telecommunications and video surveillance equipment and services from Huawei, ZTE, Hytera, Hikvision, Dahua, and their subsidiaries and affiliates from every procurement, contract extension, and renewal, and from use as a substantial or essential component of any system; obtain the FAR 52.204-24 and 52.204-26 representations before award and keep them in the contract file. (FAR 52.204-25; FY2019 NDAA § 889)

FAR 52.204-23: Prohibition on Kaspersky Lab Covered Entities

• The organization must exclude hardware, software, and services developed or provided by Kaspersky Lab covered entities from acquisition and use, and remove any found in the inventory; the prohibition rests on FAR 52.204-23, CISA BOD 17-01, and the ICTS final determination under 15 CFR Part 791 that barred the products for U.S. persons from 2024-09-29. (FAR 52.204-23; BOD 17-01; 15 CFR Part 791)

FAR 52.204-27: Prohibition on a ByteDance Covered Application

• The organization must prohibit the presence or use of any application or service that ByteDance Limited, or an entity in which ByteDance holds a controlling ownership stake, develops or provides, on information technology the organization owns or that contractors use in performance of its contracts, except under an exception the law authorizes; enforce the prohibition through device management. Contracting Officers include FAR 52.204-27 in solicitations and contracts as the FAR requires. The TikTok app run by the TikTok U.S. Data Security Joint Venture is no longer a covered application. (FAR 52.204-27; Consolidated Appropriations Act, 2023, Div. R § 102; Department of Justice Office of Legal Counsel opinion (July 16, 2026))

SECURE Technology Act: Strengthening and Enhancing Cyber-capabilities by Utilizing Risk Exposure Technology Act (SECURE Technology Act) — Federal Acquisition Security Council

• The organization must assess supply chain risks, prioritizing by the criticality of the mission, system, component, or service, and avoid, mitigate, accept, or transfer each risk. (41 U.S.C. § 1326(a))
• The organization must share relevant supply chain risk information with the Federal Acquisition Security Council as the Council’s rules require. (41 U.S.C. § 1323; 41 CFR Part 201-1)
• The organization must assess supply chain risk before award for covered procurements, and exclude a source under 41 U.S.C. 4713 only with the required written determination. (41 U.S.C. § 4713; 41 U.S.C. § 1326)

FASCSA Exclusion and Removal Order 2026-01: Exclusion and Removal of DeepSeek Products and Services from Federal Civilian Executive Branch Information Technology Systems

• The organization must exclude DeepSeek, its affiliated entities, and their products from every procurement, including approved products lists, service provider equipment lists, and e-commerce markets. Deadline: Effective immediately after the order’s issuance. (FASCSA Exclusion and Removal Order 2026-01)
• The organization must remove DeepSeek products, and third-party products and services built using DeepSeek implementations, from Organization systems at once, or ask the issuing official for an exception. Deadline: Removal immediately after issuance; a written exception request within 60 days of issuance. (FASCSA Exclusion and Removal Order 2026-01)
• The organization must send any request for an exception to the order in writing within 60 days of its issuance, with the justification and the other mitigations the order lists. Deadline: 60 days after issuance. (FASCSA Exclusion and Removal Order 2026-01; 41 CFR 201-1.304(b))

FASCSA Exclusion and Removal Order 2026-02: Exclusion and Removal of Acronis Products and Services from Federal Civilian Executive Branch Information Technology Systems

• The organization must exclude products and services that Acronis AG and its affiliates supply, directly or indirectly, from every ongoing and future procurement, including approved products lists, service provider equipment lists, and e-commerce markets. Deadline: Effective immediately after the order’s issuance. (FASCSA Exclusion and Removal Order 2026-02)
• The organization must remove products and services that Acronis AG and its affiliates supply from Organization systems, including systems a contractor runs for the Organization, within 180 calendar days of the order’s issuance, or ask the issuing official for an exception. Deadline: Removal within 180 calendar days of issuance; a written exception request within 60 days of issuance. (FASCSA Exclusion and Removal Order 2026-02)
• The organization must send any request for an exception to the order in writing within 60 days of its issuance to FASCSA.Orders@cisa.dhs.gov, with the justification and the other mitigations the order lists. Deadline: 60 days after issuance. (FASCSA Exclusion and Removal Order 2026-02; 41 CFR 201-1.304(b))

NIST SP 800-160: Engineering Trustworthy Secure Systems

• The organization should integrate supply chain risk management into systems engineering, including supplier assessment, component provenance tracking, and continuous monitoring of supply chain threats throughout the system lifecycle. (NIST SP 800-160v1r1, §3.4)

15 CFR Part 791: Securing the ICTS Supply Chain (EO 13873)

• The organization should treat an information and communications technology and services (ICTS) determination under EO 13873 and 15 CFR Part 791 that names a vendor or product the organization uses as a supply-chain risk event: assess the affected systems under the C-SCRM process, record the CIO’s risk decision, and remove or replace the product where the determination prohibits its use — even when no FASCSA order exists. (15 CFR Part 791; EO 13873)

FY2023 National Defense Authorization Act (NDAA) § 5949: Prohibition on Certain Semiconductor Products and Services

• The organization may prepare to exclude covered semiconductor products and services (Semiconductor Manufacturing International Corporation (SMIC), Yangtze Memory Technologies (YMTC), ChangXin Memory Technologies (CXMT), and their affiliates) from procurement and from critical systems by the statutory date, and add the implementing FAR clause to acquisition templates when the final rule issues. Deadline: 2027-12-23. (FY2023 NDAA § 5949; FR 2026-03065 (proposed rule))

4. Procedure #

4.1 General Implementation Approach #

The Organization implements the SR controls in two ways: as organization-wide common controls that systems inherit, and as system-specific implementations where a system needs them. The control-specific procedures below cover each control in the Supply Chain Risk Management family.

The Common Control Provider (CCP) implements controls marked inherited for the whole Organization. The CCP and each System Owner share the work for controls marked hybrid. Each System Owner implements controls marked customer-configured for the system.

Responsible party: The Acquisition Manager / Supply Chain Risk Manager carries out the steps in this procedure unless a control-specific procedure names someone else. The System Owner is accountable for funding and completing the work. The CISO oversees the procedure and receives its performance measures. See the SR policy (POL-SR) for the role definitions.

4.2 Control-Specific Procedures #

SR-01 — Policy and Procedures #

Baselines: Low / Moderate / High CSF 2.0: GV.RM (Risk Management Strategy), GV.SC (Cybersecurity Supply Chain Risk Management)

1. Develop, document, and disseminate to include chief privacy and ISSO and/or similar role or designees:

1. [Selection (one or more): organization-level; mission/business process-level; system-level — to be defined] supply chain risk management policy that:

1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and

2. Procedures to facilitate the implementation of the supply chain risk management policy and the associated supply chain risk management controls;

2. Designate an [Assignment: organization-defined official — to be defined] to manage the development, documentation, and dissemination of the supply chain risk management policy and procedures; and
3. Review and update the current supply chain risk management:

1. Policy at least annually and following significant changes; and
2. Procedures at least annually and following [Assignment: organization-defined events — to be defined].

Procedure:

The CISO owns POL-SR and PROC-SR and tracks their maintenance in a review record in the policy library in the document management system. Every two years, the CISO’s office collects input from the Authorizing Official (AO), System Owners, Information System Security Officers (ISSOs), the supply chain risk management (SCRM) team, and acquisition officials. The CISO’s office consolidates the proposed changes and sends the revision to the CISO for approval. The CISO’s office then sends the approved version to the AO, System Owners, ISSOs, and key stakeholders and records the distribution.

A major change to applicable policy starts the same review out of cycle. Such a change may be new federal direction, a changed acquisition rule, or a change in the Organization’s structure.

The CISO’s office withdraws superseded versions from circulation. The revision history records what changed and why.

Evidence: the review records with the collected input, the approved revisions with the CISO’s sign-off, the distribution records, and the revision history.

SR-02 — Supply Chain Risk Management Plan #

Baselines: Low / Moderate / High CSF 2.0: GV.RM (Risk Management Strategy), GV.SC (Cybersecurity Supply Chain Risk Management)

1. Develop a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal of the following systems, system components or system services: [Assignment: organization-defined systems, system components, or system services — to be defined];
2. Review and update the supply chain risk management plan at least annually or as required, to address threat, organizational or environmental changes; and
3. Protect the supply chain risk management plan from unauthorized disclosure and modification.

Procedure:

The SCRM team drafts and maintains the plan under the CISO’s direction. The organization-level plan is the Supply Chain Risk Management Strategy and Implementation Plan (PLAN-SCRM-001). Every year, the SCRM team opens the review in the policy library in the document management system. The team updates the risk picture across the acquisition life cycle. It checks the mitigation approaches against the year’s assessments and incidents, and sends the update to the CISO for approval. A threat, organizational, or environmental change starts the same update out of cycle.

In the same review, the SCRM team rebuilds the critical supplier list from the system inventories and acquisition spending and sends it to the CISO for approval. For each contractor-operated system, the ISSO confirms that the contractor has delivered a system-level SCRM plan or names the organization-level plan the system inherits. The Contracting Officer’s Representative requests any missing plan from the contractor.

The SCRM team stores the plan with access limited to the roles that carry it out. Any change to the plan requires the CISO’s approval, and the team keeps both the access history and the change history.

Evidence: the current approved plan, the yearly and out-of-cycle review records, the approved critical supplier list, the contractor system-level plans, the access and change history, and the CISO’s approval for each revision.

SR-02(1) — Establish SCRM Team #

Baselines: Low / Moderate / High

Establish a supply chain risk management team consisting of [Assignment: organization-defined personnel, roles and responsibilities — to be defined] to lead and support the following SCRM activities: [Assignment: organization-defined supply chain risk management activities — to be defined].

Procedure:

The SCRM team keeps a record of its members: the Chief Information Officer (CIO), acquisition and procurement personnel, General Counsel, and supply chain subject matter experts. The team reviews supply chain risk assessments and turns their conclusions into acquisition requirements. It advises the Contracting Officer on SCRM contract language, maintains the Organization’s supply chain risk tolerance definitions, and checks that system development life cycle (SDLC) activities apply SCRM principles at each phase. The team records its actions and decisions in the governance, risk, and compliance (GRC) system under the SCRM program. Evidence: the membership record, the meeting and decision records, and the acquisition reviews the team completed.

SR-03 — Supply Chain Controls and Processes #

Baselines: Low / Moderate / High CSF 2.0: GV.RM (Risk Management Strategy), GV.SC (Cybersecurity Supply Chain Risk Management)

1. Establish a process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes of [Assignment: organization-defined system or system component — to be defined] in coordination with [Assignment: organization-defined supply chain personnel — to be defined];
2. Employ the following controls to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events: [Assignment: organization-defined supply chain controls — to be defined]; and
3. Document the selected and implemented supply chain processes and controls in [Selection (one or more): security and privacy plans; supply chain risk management plan; [organization-defined] — to be defined].

Procedure:

Purchases go through federal-wide acquisition vehicles, including National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) and General Services Administration (GSA) Advantage, whose established practices provide the baseline protections. The Office of Acquisitions confirms vehicle use for each purchase and escalates any departure for approval before award.

When a weakness or deficiency appears, whether from a supplier assessment, a delivery anomaly, or an incident report, the CISO team records it in the GRC system. The CISO team coordinates the response with the affected Mission/Business Owner and the Office of Acquisitions and tracks the item to closure. A response can change contract terms, add inspection, or change sourcing.

The CISO records the organization-level processes and controls in the Supply Chain Risk Management Strategy and Implementation Plan (PLAN-SCRM-001). Each System Owner records what applies to the system in its System Security and Privacy Plan (SSPP).

Evidence: the acquisition records that show vehicle use, the weakness records with their coordinated responses, and the plan entries that document the controls.

SR-05 — Acquisition Strategies, Tools, and Methods #

Baselines: Low / Moderate / High CSF 2.0: GV.RM (Risk Management Strategy), GV.SC (Cybersecurity Supply Chain Risk Management)

Employ the following acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks: [Assignment: organization-defined strategies, tools, and methods — to be defined].

Procedure:

A purchase request for IT supply names its contract vehicle before it moves forward. The Office of Acquisitions checks the request against the compliant Government-wide vehicles, including the GSA Schedules and NASA SEWP.

The CISO’s staff then review the request, including any purchase-card buy. For an item a federal program has vetted, the staff screen the supplier against System for Award Management exclusions and Federal Acquisition Supply Chain Security Act orders. Network-connected devices, critical software, and components of moderate- or high-impact systems get a full supplier assessment. The CISO records a written risk determination on the ticketing system ticket before the Contracting Officer awards through the verified vehicle.

A request that cannot use a compliant vehicle stops. The requester documents why, and the CISO and the Contracting Officer record their decision.

Evidence: the acquisition tickets, the screening results and supplier assessments, the written CISO determinations, and the exception decisions.

SR-06 — Supplier Assessments and Reviews #

Baselines: Moderate / High CSF 2.0: GV.RM (Risk Management Strategy), GV.SC (Cybersecurity Supply Chain Risk Management)

Assess and review the supply chain-related risks associated with suppliers or contractors and the system, system component, or system service they provide at least annually.

Procedure:

Four events trigger a supplier assessment: a new supplier enters selection, an existing supplier’s contract status changes, a delivered product or service changes significantly, or the SCRM team reviews the critical supplier list. Each trigger opens an assessment record in the GRC system.

The CISO team assesses the supplier under its documented process. The team examines the supplier’s security and supply chain risk practices, ownership and influence considerations, publicly available and all-source information, and how the supplier manages its own subcontractors. The team writes up the findings with a risk conclusion. Before award, the CISO records a written determination that the risk is acceptable or not. The team shares the results with the Contracting Officer and the affected System Owner, who use them in selection, award, or continuation decisions.

The CISO team keeps each assessment so that the next trigger starts from the previous assessment. The Contracting Officer can turn adverse findings into contract conditions.

Evidence: the trigger records, the completed assessments with conclusions, the written CISO determinations, the shared results, and the decisions recorded against them.

SR-08 — Notification Agreements #

Baselines: Low / Moderate / High CSF 2.0: GV.RM (Risk Management Strategy), GV.SC (Cybersecurity Supply Chain Risk Management)

Establish agreements and procedures with entities involved in the supply chain for the system, system component, or system service for the notification of supply chain compromises and results of assessment or audits.

Procedure:

The Contracting Officer puts the notification terms into each agreement at award. The terms name what the supply chain entity must report and where the report goes. Staff log each incoming notification in the ticketing system on receipt and route it to the CISO team. The CISO team confirms that the report identifies the affected systems, components, or services, the risk, the extent of any compromise, and the remediation plan.

The CISO team coordinates the response with the affected System Owners and ISSOs. When the event becomes a security incident, the CISO hands it to the Incident Response Team. The team tracks the entity’s remediation and engages the Contracting Officer when the reporting or the remediation falls short of the agreement.

After the response, the SCRM team records lessons learned. The CISO shares relevant supply chain risk information with the Federal Acquisition Security Council and with affected agencies.

Evidence: the agreements that carry the notification terms, the logged notifications, the response coordination records, the remediation tracking, and the records of information shared with the Federal Acquisition Security Council.

SR-09 — Tamper Resistance and Detection #

Baselines: High

Implement a tamper protection program for the system, system component, or system service.

Procedure:

System Owners list the components that need tamper protection and send the list to the CISO for approval. For each component, the System Owner records the protections in use. Examples include tamper-evident seals, signed firmware, and secure packaging.

Before award, the Contracting Officer adds tamper protection terms to the contract. When a component arrives, staff check its seals and packaging and compare it with the order record. They record the result in the receiving record.

During use, administrators check seals and firmware during maintenance and record the result. Any staff member who sees signs of tampering reports it to the security team. The security team opens an incident and decides whether to remove the component.

The CISO reviews the program when components or suppliers change.

Evidence: the approved component list, contract terms, receiving records, maintenance records, and incident records.

SR-09(1) — Multiple Stages of System Development Life Cycle #

Baselines: High

Employ anti-tamper technologies, tools, and techniques throughout the system development life cycle.

Procedure:

During design, the System Owner chooses anti-tamper methods for each component, such as signed code and tamper-evident hardware. During acquisition, the Contracting Officer puts these methods in the contract. At delivery, staff inspect seals and check the component against the order.

During operation, administrators check seals and firmware during maintenance. At disposal, staff sanitize or destroy the component and record the result.

Evidence: the life cycle plan in the System Security Plan, contract terms, receiving and maintenance records, and disposal records.

SR-10 — Inspection of Systems or Components #

Baselines: Low / Moderate / High CSF 2.0: GV.RM (Risk Management Strategy), GV.SC (Cybersecurity Supply Chain Risk Management)

Inspect the following systems or system components [Selection (one or more): at random; at [organization-defined]; upon [organization-defined] — to be defined] to detect tampering: [Assignment: organization-defined systems or system components — to be defined].

Procedure:

The System/Application Administrator inspects every asset at deployment. The administrator opens the delivered unit’s record in the ticketing system and compares the physical device and its components with the purchase order. The administrator checks the packaging and seals for damage or interference and records the result before placing the asset in service.

A directed inspection runs the same way on demand: the CISO or the ISSO names the systems, the administrator inspects them, and the administrator records the findings on the request. An indication of need, such as damaged packaging, signs of physical tampering, or hardware specifications that do not match the order, triggers an inspection without waiting for direction.

The administrator removes a suspect asset from service, reports it to the CISO and the ISSO, and holds it until the inspection resolves the question. Confirmed tampering follows the counterfeit and incident reporting paths.

Evidence: the deployment inspection records, the directed-inspection requests with their findings, and the hold and resolution records for suspect assets.

SR-11 — Component Authenticity #

Baselines: Low / Moderate / High CSF 2.0: GV.RM (Risk Management Strategy), GV.SC (Cybersecurity Supply Chain Risk Management)

1. Develop and implement anti-counterfeit policy and procedures that include the means to detect and prevent counterfeit components from entering the system; and
2. Report counterfeit system components to [Selection (one or more): source of counterfeit component; [organization-defined]; [organization-defined] — to be defined].

Procedure:

Prevention starts with the purchase: the Organization buys through its compliant acquisition vehicles, which limits the routes a counterfeit can take. At receipt, the System/Application Administrator verifies the delivered component against the purchase order, checking the supplier, model, specifications, packaging, and labeling. The administrator records the verification in the ticketing system before the component is stocked or installed.

The administrator isolates a component that fails verification and reports it to the personnel and roles the Organization Incident Response Standard defines and to the Contracting Officer. The CISO team coordinates the security response and determines the exposure if similar components are already in service. The Contracting Officer pursues the supplier. The administrator records the component’s disposition, and the component does not return to circulation.

Evidence: the receipt verification records, the isolation and report records for suspect components, the coordination and supplier correspondence, and the recorded dispositions.

SR-11(1) — Anti-counterfeit Training #

Baselines: Low / Moderate / High

Train [Assignment: organization-defined personnel or roles — to be defined] to detect counterfeit system components (including hardware, software, and firmware).

Procedure:

The Organization delivers counterfeit-detection training to the roles that handle components: system and network administrators, ISSOs, and the CISO team. The training covers physical indicators such as packaging, labeling, and build quality; documentation and provenance checks; and how to verify that software and firmware are authentic. The Organization records each person’s completion in the learning management system (LMS), and supervisors confirm that a person has completed the training before assigning receipt or inspection duties. The records support audits, and they show whether an inspector had the training to catch a counterfeit that got through. Evidence: the training completion records in the LMS and the duty assignments that depend on them.

SR-11(2) — Configuration Control for Component Service and Repair #

Baselines: Low / Moderate / High

Maintain configuration control over the following system components awaiting service or repair and serviced or repaired components awaiting return to service: all.

Procedure:

When a component enters the service or repair path, the System/Application Administrator records its identity and configuration in the ticketing system and moves it to controlled holding. The administrator tracks each component in the repair loop: who has it, where it is, and why. On return, the administrator verifies the component against its recorded configuration, covering hardware composition, firmware, and software state, before reconnecting it, and records the verification. The administrator isolates a component that fails verification and handles it through the tampering and counterfeit reporting paths. Evidence: the custody and configuration records, the return verifications, and the isolation records for failed verifications.

SR-12 — Component Disposal #

Baselines: Low / Moderate / High CSF 2.0: GV.RM (Risk Management Strategy), GV.SC (Cybersecurity Supply Chain Risk Management)

Dispose of [Assignment: organization-defined data, documentation, tools, or system components — to be defined] using the following techniques and methods: [Assignment: organization-defined techniques and methods — to be defined].

Procedure:

A disposal action opens in the ticketing system, whether it retires a whole system or a single drive removed during operation. The System/Application Administrator sanitizes or destroys the item using the technique the Organization Media Sanitization and Destruction Procedure prescribes for its media type and sensitivity. The administrator records the method, the operator, and the outcome on the ticket. The administrator then closes the asset’s records under the Organization Asset Management Procedure so that the inventory shows the disposition.

For personally identifiable information (PII), systems that support primary mission essential functions, High Value Assets, and critical software, the ISSO verifies the sanitization record before the ticket closes. The ISSO treats a disposal without a record as a potential loss of control and escalates it to the CISO.

Evidence: the disposal tickets with recorded methods and outcomes, the updated asset records, and the ISSO’s verification for each in-scope disposal.

4.3 Supply Chain Event Handling and Pre-Award Review #

The CISO runs these steps with the Contracting Officer and the Incident Response Team. The CISO records every event, review, and decision in the GRC system.

Step 1: Handle a supply chain event #

Find out whether an event is an incident and respond to it.

Step 2: Review each purchase before award #

The CISO sets the depth of each review by what the purchase is.

1. Light review: products and services already vetted through a federal program, such as Federal Risk and Authorization Management Program (FedRAMP) or a governmentwide contract. The CISO checks the supplier against exclusions in the System for Award Management, Federal Acquisition Security Council orders, and statutory bans such as section 889.
2. Full review: network-connected devices, critical software as Office of Management and Budget (OMB) M-21-30 defines it, and parts of moderate-impact or high-impact systems. The CISO assesses the supplier’s security practices, ownership, and own suppliers.
3. Purchase card buys: the cardholder sends each IT purchase to the CISO for review before buying.

The CISO records the result in writing. The Contracting Officer awards only after that record exists.

Step 3: Exclude a source #

Use the exclusion authority in 41 U.S.C. 4713 when a risk cannot be reduced.

Step 4: Review critical suppliers #

Reassess the suppliers the Organization depends on most.

Evidence: the event reports and incident decisions, the information shared with the Federal Acquisition Security Council, each pre-award review, and the critical supplier reviews.

Source: Federal Acquisition Supply Chain Security Act of 2018 (41 U.S.C. 1321-1328); 41 CFR Part 201-1; 41 U.S.C. 4713; NIST SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (2022).

5. Parameters (ODP Values) #

The following organization-defined parameters apply to controls in this family:

6. Evidence Artifacts #

Carrying out this procedure produces these records:

• Procedure execution records for SR
• Configuration documentation
• Periodic review records
• Evidence for IG FISMA metric C-SCRM.01
• Evidence for IG FISMA metric C-SCRM.06

7. Performance Measurement #

The CISO measures this procedure with the indicators below, which meet IG FISMA Level 4 (Managed and Measurable). The ISSO collects the data, and the CISO trends and reports it. When a measure moves away from its target, the CISO starts corrective action through the plan of action and milestones (POA&M) process.

8. Training Requirements #

Before they carry out the steps in this procedure, and every year after, the people who perform them must complete:

• General security awareness training, which all personnel take under POL-AT.
• Role-based training on this procedure’s steps, tools, and evidence.
• Training on the technology platforms listed under Technology Implementation, matched to their duties.

Completion is a condition of continued access. The Agency Learning Management System (LMS) holds the completion records.

9. Governance References #

• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.
• Executive Order 13873: Securing the Information and Communications Technology and Services Supply Chain, May 15, 2019.
• FAR 52.204-23: Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab Covered Entities, July 16, 2018.
• FAR 52.204-25: Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment (Section 889; with FAR 52.204-24 and 52.204-26 representations), August 13, 2020.
• FAR 52.204-27: Prohibition on a ByteDance Covered Application, June 2, 2023.
• FAR 52.204-30: Federal Acquisition Supply Chain Security Act Orders — Prohibition (with FAR 52.204-29 representation and disclosures), December 4, 2023.
• Exclusion and Removal of DeepSeek Products and Services from Federal Civilian Executive Branch Information Technology Systems, July 24, 2026.
• Exclusion and Removal of Acronis Products and Services from Federal Civilian Executive Branch Information Technology Systems, July 31, 2026.
• Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
• OMB M-26-05: Adopting a Risk-based Approach to Software and Hardware Security, January 23, 2026.
• NIST SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, November 1, 2024.
• NIST SP 800-218: Secure Software Development Framework (SSDF), February 2022.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• 15 CFR Part 791: Securing the Information and Communications Technology and Services Supply Chain, July 18, 2024.
• 41 CFR Part 201-1: Federal Acquisition Security Council (FASC) — Rules and Procedures, August 26, 2021.
• 2026 Minimum Elements for a Software Bill of Materials (SBOM) — CISA/NSA/FBI joint guidance: CISA/NSA/FBI joint guidance, July 29, 2026.
• CISA BOD 17-01: Removal of Kaspersky-branded Products, September 13, 2017.
• Executive Order 14028: Improving the Nation’s Cybersecurity, May 12, 2021.
• FAR: Prohibition on Certain Semiconductor Products and Services (proposed rule implementing FY2023 NDAA §5949), February 17, 2026.
• Functions and authorities of the Federal Acquisition Security Council (41 U.S.C. § 1323), December 21, 2018.
• NIST Cybersecurity Framework 2.0, February 26, 2024.
• NIST SP 800-160 Rev. 1: Engineering Trustworthy Secure Systems, November 2022.
• OMB M-21-30: Protecting Critical Software Through Enhanced Security Measures, August 10, 2021.
• Requirements for executive agencies (Federal Acquisition Supply Chain Security Act) (41 U.S.C. § 1326), December 21, 2018.