03.17 Supply Chain Risk Management...

Phase 1 - A suggested method would be to include in your policy, a statement that specifically addresses supply chain risk management, in line with NIST 800-171 Revision 3. This section should detail our plan for identifying, assessing, and mitigating supply chain risks. We need to outline our acquisition strategies, including how we vet and select vendors, and what tools we'll use to monitor for potential threats and vulnerabilities. Crucially, this policy section must also document the specific controls and processes we'll implement to address any identified supply chain weaknesses, ensuring we're proactively managing risks from our external providers.