id: "PM-30(01)" title: "Suppliers of Critical or Mission-essential Items" family: "PM" family_name: "Program Management" sort_id: "pm-30.01" priority: "P1" implementation_level: "organization" parent: "PM-30" enhancement: True
Statement
Identify, prioritize, and assess suppliers of critical or mission-essential technologies, products, and services.
Guidance
The identification and prioritization of suppliers of critical or mission-essential technologies, products, and services is paramount to the mission/business success of organizations. The assessment of suppliers is conducted using supplier reviews (see SR-6 ) and supply chain risk assessment processes (see RA-3(1) ). An analysis of supply chain risk can help an organization identify systems or components for which additional supply chain risk mitigations are required.
Assessment Objective: suppliers of critical or mission-essential technologies, products, and services are identified;
Assessment Objective: suppliers of critical or mission-essential technologies, products, and services are prioritized;
Assessment Objective: suppliers of critical or mission-essential technologies, products, and services are assessed.
Supply chain risk management strategy
organization-wide risk management strategy
enterprise risk management documents
inventory records or suppliers
assessment and prioritization documentation
critical or mission-essential technologies, products, and service documents or records
other relevant documents or records
Organizational personnel with supply chain risk management responsibilities
organizational personnel with information security responsibilities
organizational personnel with acquisition responsibilities
organizational personnel with enterprise risk management responsibilities
Organizational processes for identifying, prioritizing, and assessing critical or mission-essential technologies, products, and services
organizational processes for maintaining an inventory of suppliers
organizational process for associating suppliers with critical or mission-essential technologies, products, and services