---
tags:
  - 20x
  - Cloud Service Providers
  - Key Security Indicators
---

<span class="picto">:lucide-computer:{ .machine title="This content is machine-generated from FedRAMP Machine-Readable Rules." }</span>

# Supply Chain Risk






### Mitigating Supply Chain Risk

??? abstract "KSI-SCR-MIT"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Persistently identify, review, and mitigate potential supply chain risks.



    **Related SP 800-53 Controls:** [AC-20](../../../reference/controls/access-control.md#ac-20){ data-preview }, [RA-03 (01)](../../../reference/controls/risk-assessment.md#ra-03-01){ data-preview }, [SA-09](../../../reference/controls/system-and-services-acquisition.md#sa-09){ data-preview }, [SA-10](../../../reference/controls/system-and-services-acquisition.md#sa-10){ data-preview }, [SA-11](../../../reference/controls/system-and-services-acquisition.md#sa-11){ data-preview }, [SA-15 (03)](../../../reference/controls/system-and-services-acquisition.md#sa-15-03){ data-preview }, [SA-22](../../../reference/controls/system-and-services-acquisition.md#sa-22){ data-preview }, [SI-07 (01)](../../../reference/controls/system-and-information-integrity.md#si-07-01){ data-preview }, [SR-05](../../../reference/controls/supply-chain-risk-management.md#sr-05){ data-preview }, [SR-06](../../../reference/controls/supply-chain-risk-management.md#sr-06){ data-preview }, [CA-07 (04)](../../../reference/controls/assessment-authorization-and-monitoring.md#ca-07-04){ data-preview }, [SC-18](../../../reference/controls/system-and-communications-protection.md#sc-18){ data-preview }

    ---
    **Terms:** [Persistently](../../../definitions/#persistently){ data-preview }
### Monitoring Supply Chain Risk

??? abstract "KSI-SCR-MON"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Third party software information resources are automatically monitored for upstream vulnerabilities using mechanisms that may include contractual notification requirements or active monitoring services.



    **Related SP 800-53 Controls:** [AC-20](../../../reference/controls/access-control.md#ac-20){ data-preview }, [CA-03](../../../reference/controls/assessment-authorization-and-monitoring.md#ca-03){ data-preview }, [IR-06 (03)](../../../reference/controls/incident-response.md#ir-06-03){ data-preview }, [PS-07](../../../reference/controls/personnel-security.md#ps-07){ data-preview }, [RA-05](../../../reference/controls/risk-assessment.md#ra-05){ data-preview }, [SA-09](../../../reference/controls/system-and-services-acquisition.md#sa-09){ data-preview }, [SI-05](../../../reference/controls/system-and-information-integrity.md#si-05){ data-preview }, [SR-05](../../../reference/controls/supply-chain-risk-management.md#sr-05){ data-preview }, [SR-06](../../../reference/controls/supply-chain-risk-management.md#sr-06){ data-preview }, [SR-08](../../../reference/controls/supply-chain-risk-management.md#sr-08){ data-preview }

    ---
    **Terms:** [Information Resource](../../../definitions/#information-resource){ data-preview }, [Vulnerability](../../../definitions/#vulnerability){ data-preview }
