Enterprise Controls Framework for the Supply Chain domain — the optimised set of process controls that give effect to its technical controls.
6 process controls, grouped by sub-policy and shown in full six-level lineage with operational artifacts.
CAO-700 Supply Chain
CAO-710 Vendor and Third-Party Risk Management Policy
CAO-700 Supply Chain › CAO-710 Vendor and Third-Party Risk Management Policy › CAO-711 Supplier and Supply-Chain Security › CAO-7111 Govern supplier and ICT supply-chain security › CAO-71111 Supplier and ICT supply-chain security risks governed through assessment, agreements and monitoring.
CAO-711111 · Examine supplier risk assessments and agreements to confirm supply-chain security is governed.
Method: Examine · Expected evidence: Supplier risk assessments and security agreements
Operational controls: CAO-7111112 Supplier Security Agreement Template · CAO-7111111 Supplier Security Register
CAO-700 Supply Chain › CAO-710 Vendor and Third-Party Risk Management Policy › CAO-712 Supply-Chain Risk Management Programme › CAO-7121 Establish and operate a supply-chain risk management programme › CAO-71211 Supply-chain risk management plan established, maintained and applied
CAO-712111 · Examine the supply-chain risk management plan and programme records to confirm it operates
Method: examine · Expected evidence: C-SCRM plan and programme records
Operational controls: CAO-7121111 Supply-Chain Risk Management Plan — template
CAO-700 Supply Chain › CAO-710 Vendor and Third-Party Risk Management Policy › CAO-712 Supply-Chain Risk Management Programme › CAO-7121 Establish and operate a supply-chain risk management programme › CAO-71212 Provenance, authenticity and integrity of components ensured across the supply chain
CAO-712121 · Examine provenance records and component inspections to confirm authenticity and integrity
Method: examine · Expected evidence: provenance and inspection records
Operational controls: CAO-7121211 Component Provenance Register
CAO-700 Supply Chain › CAO-710 Vendor and Third-Party Risk Management Policy › CAO-712 Supply-Chain Risk Management Programme › CAO-7121 Establish and operate a supply-chain risk management programme › CAO-71213 Suppliers assessed, monitored and bound by security notification agreements
CAO-712131 · Examine supplier assessments, inventories and agreements to confirm ongoing assurance
Method: examine · Expected evidence: supplier assessment and inventory records
Operational controls: CAO-7121311 Supplier Assessment and Inventory Register
CAO-700 Supply Chain › CAO-710 Vendor and Third-Party Risk Management Policy › CAO-712 Supply-Chain Risk Management Programme › CAO-7122 Analyse and treat supply-chain threat scenarios and risk exposure › CAO-71221 Supply-chain threat scenarios developed, assessed and treated via the risk exposure framework
CAO-712211 · Examine documented threat scenarios, exposure assessments and treatment decisions
Method: examine · Expected evidence: threat scenario records; exposure assessments
Operational controls: CAO-7122111 Supply Chain Threat Scenario Register
CAO-700 Supply Chain › CAO-710 Vendor and Third-Party Risk Management Policy › CAO-712 Supply-Chain Risk Management Programme › CAO-7123 Determine and tier the criticality of suppliers, components and services › CAO-71231 Criticality of functions, suppliers, components and services determined and tiered
CAO-712311 · Examine criticality determinations and tiering against missions and business processes
Method: examine · Expected evidence: criticality analysis records
Operational controls: CAO-7123111 Supplier and Component Criticality Register