---

id: "PM-30" title: "Supply Chain Risk Management Strategy" family: "PM" family_name: "Program Management" sort_id: "pm-30" priority: "P1" implementation_level: "organization" enhancements: - pm-30.1

---

Develop an organization-wide strategy for managing supply chain risks associated with the development, acquisition, maintenance, and disposal of systems, system components, and system services;

Implement the supply chain risk management strategy consistently across the organization; and

Review and update the supply chain risk management strategy on {{ insert: param, pm-30_odp }} or as required, to address organizational changes.

Guidance

An organization-wide supply chain risk management strategy includes an unambiguous expression of the supply chain risk appetite and tolerance for the organization, acceptable supply chain risk mitigation strategies or controls, a process for consistently evaluating and monitoring supply chain risk, approaches for implementing and communicating the supply chain risk management strategy, and the associated roles and responsibilities. Supply chain risk management includes considerations of the security and privacy risks associated with the development, acquisition, maintenance, and disposal of systems, system components, and system services. The supply chain risk management strategy can be incorporated into the organization’s overarching risk management strategy and can guide and inform supply chain policies and system-level supply chain risk management plans. In addition, the use of a risk executive function can facilitate a consistent, organization-wide application of the supply chain risk management strategy. The supply chain risk management strategy is implemented at the organization and mission/business levels, whereas the supply chain risk management plan (see SR-2 ) is implemented at the system level.

Assessment Objective: an organization-wide strategy for managing supply chain risks is developed;

Assessment Objective: the supply chain risk management strategy addresses risks associated with the development of systems;

Assessment Objective: the supply chain risk management strategy addresses risks associated with the development of system components;

Assessment Objective: the supply chain risk management strategy addresses risks associated with the development of system services;

Assessment Objective: the supply chain risk management strategy addresses risks associated with the acquisition of systems;

Assessment Objective: the supply chain risk management strategy addresses risks associated with the acquisition of system components;

Assessment Objective: the supply chain risk management strategy addresses risks associated with the acquisition of system services;

Assessment Objective: the supply chain risk management strategy addresses risks associated with the maintenance of systems;

Assessment Objective: the supply chain risk management strategy addresses risks associated with the maintenance of system components;

Assessment Objective: the supply chain risk management strategy addresses risks associated with the maintenance of system services;

Assessment Objective: the supply chain risk management strategy addresses risks associated with the disposal of systems;

Assessment Objective: the supply chain risk management strategy addresses risks associated with the disposal of system components;

Assessment Objective: the supply chain risk management strategy addresses risks associated with the disposal of system services;

Assessment Objective: the supply chain risk management strategy is implemented consistently across the organization;

Assessment Objective: the supply chain risk management strategy is reviewed and updated {{ insert: param, pm-30_odp }} or as required to address organizational changes.

Supply chain risk management strategy

organizational risk management strategy

enterprise risk management documents

other relevant documents or records

Organizational personnel with supply chain risk management responsibilities

organizational personnel with information security responsibilities

organizational personnel with acquisition responsibilities

organizational personnel with enterprise risk management responsibilities