tpm-02-third-partycriticalityassessments.md

SCF - TPM-02 - Third-Party Criticality Assessments

Mechanisms exist to identify, prioritize and assess suppliers and partners of critical systems, components and services using a supply chain risk assessment process relative to their importance in supporting the delivery of high-value services.

Mapped framework controls

ISO 27002

• A.5.19

NIST 800-53

• RA-9

SOC 2

• CC9.1

Control questions

Does the organization identify, prioritize and assess suppliers and partners of critical systems, components and services using a supply chain risk assessment process relative to their importance in supporting the delivery of high-value services?