C-SCRM Strategy & Implementation Plan

ComplianceForge is pleased to announce the release of a new product: Cybersecurity Supply Chain Risk Management (C-SCRM) Strategy & Implementation Plan. This is based on the recently-released NIST SP 800-161 Rev 1 and is focused on operationalizing an organization's C-SCRM plan. This editable documentation can save hundreds of hours of research and writing time that allows an organization to hit the ground running on C-SCRM.

Product Page: https://complianceforge.com/product/nist-800-161-cscrm-strategy-implementation-plan 

Product highlights of the C-SCRM SIP include:

• Country-based risk guidance to determine minimum management decision levels for conducting operations in or contracting with suppliers from countries that pose a legitimate C-SCRM threat.
• The prioritized implementation plan contains mappings for NIST SP 800-161 R1 controls to each C-SCRM implementation phase.
• Professionally-written, editable documentation template that leverages industry-recognized "best practices" for C-SCRM.
• Cost-effective solution to quickly generate documentation for a C-SCRM strategy and implementation plan.
• Example flow-down contract requirements for suppliers, vendors, subcontractors, etc. (DFARS/CMMC, ISO 27001, NIST CSF, NIST 800-53, FAR, PCI DSS, and EU GDPR/CCPA).

To properly manage supply chain-related threats, an organization must evaluate country-based threats posed by its supply chain. This review must cover the geographic concerns where your products, services and support originate from or transit through:

• Transmit, process and/or store your company's or its clients’, data across the SISP's systems, applications and/or services;
• Manufacture products or product components used in your company's operations and/or products; and/or
• Provide services for your company's operations and/or products.

Within the C-SCRM SIP, that criteria for geographic-specific threat management is refined by guidance from:

• Priority Watch List & Watch List
• Corruption Perceptions Index
• Notorious Markets List
• Designated State Sponsors of Terrorism
• EAR / ITAR restrictions
• Potentially hostile data localization laws