Aviation supply chain cybersecurity covers: (a) Executive Order 14028 'Improving the Nation's Cybersecurity' SBOM + secure software development practices + NIST SSDF (SP 800-218) alignment; (b) CISA Cyber Performance Goals (CPGs) v1.0.1 + sector-specific CPGs for aviation; (c) Federal Acquisition Regulation (FAR) + Defense Federal Acquisition Regulation Supplement (DFARS) cybersecurity clauses for aviation contracts including DFARS 252.204-7012 + 7019 + 7020 + 7021 (CMMC); (d) the Foreign Investment Risk Review Modernization Act (FIRRMA) + CFIUS reviews for critical-technology aviation acquisitions; (e) the Countering CCP Drones Act + American Security Drone Act restrictions on country-of-concern aviation electronics; (f) Aviation Cyber Initiative (ACI) supply chain working group + industry-FAA-DOT-DHS-DOD coordination on critical aviation technology supply chains. Supply chain cybersecurity is particularly acute in aviation because of the global aircraft + avionics + IT supply chain spanning 30+ countries.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.