Supply chain risk management policy
supply chain risk management procedures
supply chain risk management strategy
supply chain risk management plan
systems and critical system components inventory documentation
system and services acquisition policy
system and services acquisition procedures
procedures addressing the integration of information security and privacy requirements into the acquisition process
solicitation documentation
acquisition documentation (including purchase orders)
service level agreements
acquisition contracts for systems or services
risk register documentation
system security plan
privacy plan
other relevant documents or records