SR-5: Acquisition Strategies, Tools, and Methods

strategies, tools, and methods are employed to protect against supply chain risks;

strategies, tools, and methods are employed to identify supply chain risks;

strategies, tools, and methods are employed to mitigate supply chain risks.

Supply chain risk management policy

supply chain risk management procedures

supply chain risk management plan

system and services acquisition policy

system and services acquisition procedures

procedures addressing supply chain protection

procedures addressing the integration of information security and privacy requirements into the acquisition process

solicitation documentation

acquisition documentation (including purchase orders)

service level agreements

acquisition contracts for systems, system components, or services

documentation of training, education, and awareness programs for personnel regarding supply chain risk

system security plan

privacy plan

other relevant documents or records

Organizational personnel with acquisition responsibilities

organizational personnel with information security and privacy responsibilities

organizational personnel with supply chain risk management responsibilities

Organizational processes for defining and employing tailored acquisition strategies, contract tools, and procurement methods

mechanisms supporting and/or implementing the definition and employment of tailored acquisition strategies, contract tools, and procurement methods