The file's text, extracted by GovTribe without its formatting.
This contract and its associated delivery/contract are subject to the Federal SCRM policies and regulations including the Defense Federal Acquisition Regulation Supplement (DFARS) 252.239-7017 Notice of Supply Chain Risk, DFARS 252.239-7018 Supply Chain Risk, DoD Instruction 5200.44 Protection of Mission Critical Functions to Achieve Trusted Systems and Networks, Section 806 of theFY2011 NDAA Requirements for Information Relating to Supply Chain Risk, and internal DISA SCRM Processes and Procedures.
The contractor shall submit a SCRM plan as part of its technical proposal that describes how the contractor will reduce and mitigate Supply Chain Risk using the security controls outlined below (further described in CNSSI 1253, Appendix D and NIST SP 800-53), as applicable to your contract.
| Control Number |
| Control Name |
Control Enhancement Name
| IR-4(10) |
| Incident Handling/Supply Chain Coordination |
| IR-6(3) |
| Incident Reporting/Supply Chain Coordination |
| PE-3(5) |
| Physical Access Control/Tamper Protection |
| PL-8(2) |
| Security and Privacy Architectures/Supplier Diversity |
| PM-16 |
| Threat Awareness Program |
| RA-9 |
| Criticality Analysis |
| RA-3(1) |
| Risk Assessment/Supply Chain Risk Assessment |
| RA-3(2) |
| Risk Assessment/Use of All-source Intelligence |
| SA-11 |
| Developer Testing and Evaluation |
| SA-5 |
| System Documentation |
| SA-9(3) |
| External System Services/Establish and Maintain Trust Relationship with Providers |
| SI-7 |
| Software, Firmware, and Information Integrity |
| SR-11(2) |
| Component Authenticity/Configuration Control for Component Service and Repair |
| SR-11(3) |
| Component Authenticity/Anti-Counterfeit Scanning |
| SR-2(1) |
| Supply Chain Risk Management Plan/Establish SCRM team |
| SR-3(1) |
| Supply Chain Controls and Processes/Diverse Supply Base |
| SR-3(2) |
| Supply Chain Controls and Processes/Limitation of harm |
| SR-3(3) |
| Supply Chain Controls and Processes/Sub-Tier Flow Down |
| SR-4(1) |
| Provenance/Identity |
| SR-4(2) |
| Provenance/Track and Trace |
| SR-4(3) |
| Provenance/Validate as Genuine and not Altered |
| SR-4(4) |
| Provenance/Supply Chain Integrity — Pedigree |
| SR-5 |
| Acquisition Strategies, Tools, and Methods |
| SR-5(1) |
| Acquisition Strategies, Tools, and Methods/Adequate Supply |
| SR-5(2) |
| Acquisition Strategies, Tools, and Methods/Assessments prior to Selection, Acceptance, Modification, or Update |
| SR-6 |
| Supplier Assessments and Reviews |
| SR-6(1) |
| Supplier Assessments and Reviews/Testing and Analysis |
| SR-7 |
| Supply Chain Operations Security |
| SR-8 |
| Notification Agreements |
| SR-9(1) |
| Tamper Resistance and Detection/Multiple Stages of System Development Life Cycle |
DELIVERABLES:
SUPPLY CHAIN RISK MANAGEMENT PLAN UPDATE: The contractor shall provide an updated SCRM Plan to the COR and Program Manager within five (5) business days whenever there is a change that affects one or more security controls as described in the Committee on National Security Systems Instructions (CNSSI) 1253 Appendix D (companion publication to National Institute of Standards and Technology (NIST) Special Publication (SP)). At a minimum, the following events will require a SCRM Update: changes in company ownership, changes in senior company leadership, supplier changes, subcontractor changes, and Information and Communications Technology (ICT) supply chain compromises.
Defense Information Systems Agency