| name | PM-30_supply-chain-risk-management-strategy |
| description | Develop an organization-wide strategy for managing supply chain risks associated with the development, acquisition, maintenance, and disposal of sy... |
| category | configuration |
| version | 5.2.0 |
| author | cyberstrike-official |
| tags | ["nist","sp800-53","rev5","pm-30","pm"] |
| tech_stack | ["any"] |
| cwe_ids | [] |
| chains_with | ["CM-10","PM-9","SR-1","SR-2","SR-3","SR-4","SR-5","SR-6","SR-7","SR-8"] |
| prerequisites | [] |
| severity_boost | {"CM-10":"Chain with CM-10 for comprehensive security coverage","PM-9":"Chain with PM-9 for comprehensive security coverage","SR-1":"Chain with SR-1 for comprehensive security coverage"} |
PM-30 Supply Chain Risk Management Strategy
High-Level Description
Family: Program Management (PM)
Framework: NIST SP 800-53 Rev 5
An organization-wide supply chain risk management strategy includes an unambiguous expression of the supply chain risk appetite and tolerance for the organization, acceptable supply chain risk mitigation strategies or controls, a process for consistently evaluating and monitoring supply chain risk, approaches for implementing and communicating the supply chain risk management strategy, and the associated roles and responsibilities. Supply chain risk management includes considerations of the security and privacy risks associated with the development, acquisition, maintenance, and disposal of systems, system components, and system services. The supply chain risk management strategy can be incorporated into the organization’s overarching risk management strategy and can guide and inform supply chain policies and system-level supply chain risk management plans. In addition, the use of a risk executive function can facilitate a consistent, organization-wide application of the supply chain risk management strategy. The supply chain risk management strategy is implemented at the organization and mission/business levels, whereas the supply chain risk management plan (see SR-2 ) is implemented at the system level.
What to Check
How to Test
Step 1: Review Documentation
Examine the System Security Plan (SSP) and related artifacts for PM-30 implementation details. Verify the organization has documented how this control is satisfied.
Step 2: Validate Implementation
# For cloud environments, use cloud-audit-mcp tools
# For on-premises, review system configurations directly
# Example: Check if account management policies exist
grep -r "account.management\|access.control" /etc/security/ 2>/dev/null
Step 3: Test Operating Effectiveness
Verify the control is actively functioning, not just documented. Check logs, configurations, and operational evidence.
Tools
| Tool | Purpose | Usage |
|---|
| Manual Review |
