Acquisition Strategies, Tools, and Methods SR-5

Supply Chain Risk Management · Low baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds SR-5 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, Supply Chain Risk Management family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

SR-5 (Acquisition Strategies, Tools, and Methods) is about how you buy things so that supply chain risk is lower before a component ever arrives. It asks you to pick deliberate strategies, contract terms, and purchasing methods — like buying only from trusted sources, requiring security terms in agreements, and verifying what you receive — to protect against, spot, and reduce tampered or counterfeit parts and software. It is a Low-baseline control.

What good looks like

Choose acquisition strategies on purpose — buy from trusted, named sources rather than whatever is cheapest or closest.
Put security requirements in contracts and agreements so suppliers are on the hook for what they deliver.
Use methods that let you verify what arrived — checksums, signatures, and provenance — before you trust it.
Prefer signed, official software sources over random downloads, and keep a record of where each component came from.
Aim the whole effort at three things: protect against, identify, and mitigate supply chain risk.

Framework mapping

NIST CSF 2.0 — GV.SC-05 — Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
CIS Controls v8 — Control 15 — Service Provider Management

How to move it toward Implemented

On this server, install only from trusted, signed repositories — confirm the repository’s GPG (GNU Privacy Guard) key is in place by checking files under /etc/apt/trusted.gpg.d/ (Debian and Ubuntu) or the gpgcheck=1 setting in /etc/yum.repos.d/ (Red Hat family).
When you download software by hand, verify it before use — compare a published checksum with sha256sum and check any signature with gpg --verify.
Write down your purchasing rule (approved sources, required security terms, and how receipts are verified) so the practice is repeatable, not ad hoc.
Attach that record — the source list plus a sample verification — as hardening evidence on the asset, naming SR-5 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.