Supply Chain Risk¶

This template is the starting point for how your organization identifies, reviews, and mitigates supply chain risk in the cloud service offering, monitors third-party software for upstream vulnerabilities, and keeps third-party resources configured the way their own providers recommend. These are your procurement, engineering, and vendor management practices. Fill in the sample sections with what your organization actually does, then keep the third-party resource records in the platform current so the evidence matches the practice.

Download the KB article (Markdown)

Requirements this document answers¶

Three Key Security Indicators. No FedRAMP Rule (FRR) in the 2026 Consolidated Rules names a supply chain document; the obligation is the KSI outcome. Third-party resource documentation under MAS-CSO-TPR is a separate, platform-executed practice and lives in the Asset, Inventory, and Assessment Scope Policy and Procedures.

Sample practice: identifying and mitigating supply chain risk¶

Sample text. [Organization] treats every third-party information resource in the offering as a supply chain risk to be assessed before adoption and reviewed on a standing cadence. Before a resource is introduced, [role] performs a review covering: what the resource does in the offering and what data reaches it, the provider's own security posture and authorization status, the concentration and single-point-of-failure risk it introduces, the exit path if the provider fails or is compromised, and the contractual security commitments obtained. Findings are recorded against the resource with a risk rating and the mitigations applied. Adoption requires approval from [approval role].

Sample text. Adopted resources are re-reviewed [cadence], and out of cycle on any of these triggers: a security incident at the provider, a change in the provider's authorization or certification status, a change in what the resource does in the offering, a change of ownership at the provider, or a change to the data that reaches it. Each review restates the risk rating and the current mitigations. Mitigations that no longer hold are raised as findings with owners and due dates.

Replace with your practice. Name the reviewing role, the approval role, the review triggers, and the risk rating scheme. "Persistently" in KSI-SCR-MIT means the review has a cadence, so put a real interval in the values table.

Sample practice: monitoring for upstream vulnerabilities¶

Sample text. Third-party software in the offering is monitored automatically for upstream vulnerabilities through [mechanisms: software composition analysis on the build pipeline, registry and dependency advisory feeds, vendor security bulletin subscriptions, contractual notification clauses]. A software bill of materials is produced at build time for [scope] and reconciled against the advisory feeds [cadence]. Upstream advisories that affect a resource in the offering enter the vulnerability pipeline as detections and follow the evaluation and response timelines in the Vulnerability Detection, Evaluation, and Response Policy and Procedures; supply chain origin does not create a separate clock.

Sample text. Where a third-party provider gives no machine-readable advisory feed, notification is obtained contractually: [contract term summary], with the notification window and the recipient named in the agreement. Providers with neither an automated feed nor a contractual notification commitment are recorded as a monitoring gap with a compensating measure.

Replace with your practice. Name the tooling, the SBOM scope, and the contractual mechanism. KSI-SCR-MON accepts contractual notification or active monitoring, so be explicit about which one covers each provider.

Sample practice: configuring against provider guidance¶

Sample text. Every third-party machine-based information resource in the offering carries a reference to the original provider's security best practice or hardening guidance, and its running configuration is compared against that guidance [cadence]. The comparison is automated where the provider publishes a machine-readable benchmark or the resource exposes its settings through an API, and performed as a documented review where it is not. Deviations from provider guidance are either corrected through the change process or recorded as accepted with a stated reason and an owner. The reference and the last comparison date live on the resource's record.

Replace with your practice. Name where the provider guidance reference is held, how the comparison runs per resource class, and who accepts a deviation.

Organization-defined values¶

Evidence¶

The GRC-ITSM platform does not perform your vendor reviews, run your composition analysis, or compare your configurations against provider guidance. It evidences that the three indicators are being met, and it holds the third-party resource records the practice operates on. See the Continuous Monitoring and Reporting Policy and Procedures for the validation tree and the check cadences.

Third-party resource records are shared with the Asset, Inventory, and Assessment Scope Policy and Procedures, which owns their MAS-CSO-TPR documentation set. This template governs the risk practice; that document governs the record.

Authority, review, and revision¶

Client fills. Name the executive who issues this document, the role that owns supply chain risk, the review cadence, and the approval path for accepting a supply chain risk or a configuration deviation. Record the issue date and the revision history below.