03.17.03 Supply Chain Requirements...

This policy outlines the organization's approach to managing supply chain risks. It defines the processes for identifying and addressing weaknesses or deficiencies within the supply chain, including third-party vendors, suppliers, and subcontractors. This policy aims to ensure that all supply chain elements meet the organization's security requirements and minimize the impact of potential supply chain-related incidents.

• A.03.17.03.ODP[01]: security requirements to protect against supply chain risks to the system, system components, or system services and to limit the harm or consequences from supply chain-related events are defined.
• A.03.17.03.a[01]: a process for identifying weaknesses or deficiencies in the supply chain elements and processes is established.
• A.03.17.03.a[02]: a process for addressing weaknesses or deficiencies in the supply chain elements and processes is established.
• A.03.17.03.b: the following security requirements are enforced to protect against supply chain risks to the system, system components, or system services and to limit the harm or consequences of supply chain-related events: <A.03.17.03.ODP[01]: security requirements>.