ComplianceNIST 800-53 control

NIST-SR-5 Acquisition Strategies, Tools, and Methods

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
SR Supply Chain Risk Management
Control
SR-5
ATT&CK techniques mitigated
15

Control statement

Employ the following acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks: [Assignment: strategies, tools, and methods].

Discussion

The use of the acquisition process provides an important vehicle to protect the supply chain. There are many useful tools and techniques available, including obscuring the end use of a system or system component, using blind or filtered buys, requiring tamper-evident packaging, or using trusted or controlled distribution. The results from a supply chain risk assessment can guide and inform the strategies, tools, and methods that are most applicable to the situation. Tools and techniques may provide protections against unauthorized production, theft, tampering, insertion of counterfeits, insertion of malicious software or backdoors, and poor development practices throughout the system development life cycle. Organizations also consider providing incentives for suppliers who implement controls, promote transparency into their processes and security and privacy practices, provide contract language that addresses the prohibition of tainted or counterfeit components, and restrict purchases from untrustworthy suppliers. Organizations consider providing training, education, and awareness programs for personnel regarding supply chain risk, available mitigation strategies, and when the programs should be employed. Methods for reviewing and protecting development plans, documentation, and evidence are commensurate with the security and privacy requirements of the organization. Contracts may specify documentation protection requirements.

ATT&CK mappings (CTID)

• T1059.002 AppleScript • T1195 Supply Chain Compromise • T1195.001 Compromise Software Dependencies and Development Tools • T1195.002 Compromise Software Supply Chain • T1195.003 Compromise Hardware Supply Chain • T1204.003 Malicious Image • T1505 Server Software Component • T1505.001 SQL Stored Procedures • T1505.002 Transport Agent • T1505.004 IIS Components • T1546.006 LC_LOAD_DYLIB Addition • T1554 Compromise Host Software Binary • T1601 Modify System Image • T1601.001 Patch System Image • T1601.002 Downgrade System Image

Related

Mitigates · MITRE ATT&CK (15)

  • T1505.004 IIS Components sub-technique
  • T1204.003 Malicious Image sub-technique
  • T1601 Modify System Image technique
  • T1601.001 Patch System Image sub-technique
  • T1601.002 Downgrade System Image sub-technique
  • T1195.001 Compromise Software Dependencies and Development Tools sub-technique
  • T1195.002 Compromise Software Supply Chain sub-technique
  • T1195.003 Compromise Hardware Supply Chain sub-technique
  • T1059.002 AppleScript sub-technique
  • T1554 Compromise Host Software Binary technique
  • T1546.006 LC_LOAD_DYLIB Addition sub-technique
  • T1505.001 SQL Stored Procedures sub-technique
  • T1505.002 Transport Agent sub-technique
  • T1505 Server Software Component technique
  • T1195 Supply Chain Compromise technique

Related control · Compliance (13)

  • NIST-AT-3 Role-based Training NIST 800-53 control
  • NIST-SA-10 Developer Configuration Management NIST 800-53 control
  • NIST-SA-15 Development Process, Standards, and Tools NIST 800-53 control
  • NIST-SA-2 Allocation of Resources NIST 800-53 control
  • NIST-SA-3 System Development Life Cycle NIST 800-53 control
  • NIST-SA-4 Acquisition Process NIST 800-53 control
  • NIST-SA-5 System Documentation NIST 800-53 control
  • NIST-SA-8 Security and Privacy Engineering Principles NIST 800-53 control
  • NIST-SA-9 External System Services NIST 800-53 control
  • NIST-SR-10 Inspection of Systems or Components NIST 800-53 control
  • NIST-SR-11 Component Authenticity NIST 800-53 control
  • NIST-SR-6 Supplier Assessments and Reviews NIST 800-53 control
  • NIST-SR-9 Tamper Resistance and Detection NIST 800-53 control

Referenced by Compliance · enhancement of (2)

  • NIST-SR-5(1) Adequate Supply NIST 800-53 enhancement
  • NIST-SR-5(2) Assessments Prior to Selection, Acceptance, Modification, or Update NIST 800-53 enhancement

Referenced by Compliance · has member (1)

  • NIST-SR Supply Chain Risk Management NIST 800-53 family

Referenced by Compliance · related control (19)

  • NIST-AT-3 Role-based Training NIST 800-53 control
  • NIST-CA-8 Penetration Testing NIST 800-53 control
  • NIST-PM-30 Supply Chain Risk Management Strategy NIST 800-53 control
  • NIST-RA-9 Criticality Analysis NIST 800-53 control
  • NIST-SA-10 Developer Configuration Management NIST 800-53 control
  • NIST-SA-11 Developer Testing and Evaluation NIST 800-53 control
  • NIST-SA-15 Development Process, Standards, and Tools NIST 800-53 control
  • NIST-SA-2 Allocation of Resources NIST 800-53 control
  • NIST-SA-24 Design For Cyber Resiliency NIST 800-53 control
  • NIST-SA-3 System Development Life Cycle NIST 800-53 control
  • NIST-SA-4 Acquisition Process NIST 800-53 control
  • NIST-SA-8 Security and Privacy Engineering Principles NIST 800-53 control
  • NIST-SA-9 External System Services NIST 800-53 control
  • NIST-SI-6(3) Report Verification Results NIST 800-53 enhancement
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control
  • NIST-SR-10 Inspection of Systems or Components NIST 800-53 control
  • NIST-SR-3(3) Sub-tier Flow Down NIST 800-53 enhancement
  • NIST-SR-6 Supplier Assessments and Reviews NIST 800-53 control
  • NIST-SR-9 Tamper Resistance and Detection NIST 800-53 control