A systematic process for managing supply chain risk by identifying susceptibilities, vulnerabilities, and threats throughout the supply chain and developing mitigation strategies to combat those threats whether presented by the supplier, the supplies product and its subcomponents, or the supply chain (e.g., initial production, packaging, handling, storage, transport, mission operation, and disposal).
Source(s):
CNSSI 4009-2015
CNSSD No. 505
The process of identifying, assessing, and mitigating the risks associated with the global and distributed nature of information and communications technology product and service supply chains.
Source(s):
NIST SP 800-37 Rev. 2
under supply chain risk management
the implementation of processes, tools or techniques to minimize the adverse impact of attacks that allow the adversary to utilize implants or other vulnerabilities inserted prior to installation in order to infiltrate data, or manipulate information technology hardware, software, operating systems, peripherals (information technology products) or services at any point during the life cycle.
Source(s):
NISTIR 8074 Vol. 2
under Supply Chain Risk Management
) or https:// don't prove our archive is authentic, only that you securely accessed it. Note that we are working to fix that :)
