FedRAMP Moderate SR-2: Supply Chain Risk Management Plan (SR-2)

What else in your programme already covers this

This control maps to 44 controls across 18 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST Cybersecurity Framework 2.0 · 7 controls

NIST-CSF-GV.RM-03 Cybersecurity risk management activities and outcomes are included in enterprise risk management processes
NIST-CSF-GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders
NIST-CSF-GV.SC-02 Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally
NIST-CSF-GV.SC-03 Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes
NIST-CSF-GV.SC-06 Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships
NIST-CSF-GV.SC-09 Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle
NIST-CSF-GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement

CIS Controls v8 · 6 controls

CIS-15.1 Establish and Maintain an Inventory of Service Providers
CIS-15.2 Establish and Maintain a Service Provider Management Policy
CIS-15.3 Classify Service Providers
CIS-15.5 Assess Service Providers
CIS-15.6 Monitor Service Providers
CIS-16.4 Establish and Manage an Inventory of Third-Party Software Components

ISO 27001:2022 · 4 controls

5.19 Information security in supplier relationships
5.20 Addressing information security within supplier agreements
5.21 Managing information security in the ICT supply chain
5.22 Monitoring, review and change management of supplier services

ISO 27002:2022 · 4 controls

5.19 Information security in supplier relationships
5.20 Addressing information security within supplier agreements
5.21 Managing information security in the ICT supply chain
5.22 Monitoring, review and change management of supplier services

NIST SP 800-53 Rev 5 · 4 controls

NIST800-PM-28 Risk Framing. Identify and document: Assumptions affecting risk assessments, risk responses, and risk monitoring; Constraints affecting risk assessments, risk responses, and risk monitoring; Priorities and trade-offs considered by the organization for managing risk; and
NIST800-PM-30 Supply Chain Risk Management Strategy. Develop an organization-wide strategy for managing supply chain risks associated with the development, acquisition, maintenance, and disposal of systems, system components, and system services; Implement the supply chain risk
NIST800-SA-1 Policy and procedures for system and services acquisition
NIST800-SR-2 Supply chain risk management plan

PCI DSS 4.0 · 4 controls

12.1.2 The information security policy is: • Reviewed at least once every 12 months. • Updated as needed to reflect changes to business objectives or risks to the environment
12.5.2 PCI DSS scope documented and confirmed annually
12.8.3 TPSP due diligence
12.8.4 TPSP compliance monitored

C5 (Germany) · 3 controls

C5-SSO-01 Policies and instructions for controlling and monitoring third parties
C5-SSO-02 Risk assessment of service providers and suppliers
C5-SSO-03 Directory of service providers and suppliers

APRA CPS 230 Operational Risk Management · 2 controls

CPS230-39 Register of Material Service Providers
CPS230-P48 Required Content of the Service Provider Management Policy

APRA CPS 234 · 1 control

CPS234-16 Assessment of Related Party and Third Party Capability

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 1 control

CCM-STA-08 Supply Chain Risk Management

DORA · 1 control

DORA-Art.28 ICT third-party risk: general principles

HIPAA Security Rule · 1 control

164.314(a)(1) Business Associate Contracts or Other Arrangements (Standard)

ISO/IEC 42001:2023 · 1 control

A.10.3 Suppliers

NIS2 Directive · 1 control

Art.21.2.d Supply chain security, covering the relationship with each direct supplier and service provider

NIST SP 800-161 Rev 1 · 1 control

161R1-SR-2 Supply Chain Risk Management Plan

NIST SP 800-171 Rev 3 · 1 control

03.17.01 Supply Chain Risk Management Plan

NIST SP 800-172 · 1 control

3.11.7e Supply Chain Risk Management Plan

SOC 2 · 1 control

SOC2-CC9.2 Risk mitigation activities include assessment of vendor and business partner controls

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of FedRAMP Moderate have you already done?

FedRAMP Moderate SR-2 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of FedRAMP Moderate your existing evidence covers. Hold ISO 27002:2022 and 182 of 323 FedRAMP Moderate controls already carry evidence.

If you hold ISO 27002:202256.3% covered · 141 gaps If you hold PCI DSS 4.051.1% covered · 158 gaps If you hold ISO 27001:202249.8% covered · 162 gaps If you hold NIST SP 800-171 Rev 345.5% covered · 176 gaps If you hold C5 (Germany)37.2% covered · 203 gaps If you hold CMMC 2.035% covered · 210 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 348 were rejected on the ISO 27002:2022 pair alone.

See the released pairs, $299 each Browse the graph free