# SR-5 — Acquisition Strategies, Tools, and Methods

- **Control ID:** SR-5
- **Family:** [SR](/md/families/SR.md)
- **Baselines:** low, moderate, high
- **Enhancement of:** No content available.

## Description

Employ the following acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks: \[assignment\].

## Discussion

The use of the acquisition process provides an important vehicle to protect the supply chain. There are many useful tools and techniques available, including obscuring the end use of a system or system component, using blind or filtered buys, requiring tamper-evident packaging, or using trusted or controlled distribution. The results from a supply chain risk assessment can guide and inform the strategies, tools, and methods that are most applicable to the situation. Tools and techniques may provide protections against unauthorized production, theft, tampering, insertion of counterfeits, insertion of malicious software or backdoors, and poor development practices throughout the system development life cycle. Organizations also consider providing incentives for suppliers who implement controls, promote transparency into their processes and security and privacy practices, provide contract language that addresses the prohibition of tainted or counterfeit components, and restrict purchases from untrustworthy suppliers. Organizations consider providing training, education, and awareness programs for personnel regarding supply chain risk, available mitigation strategies, and when the programs should be employed. Methods for reviewing and protecting development plans, documentation, and evidence are commensurate with the security and privacy requirements of the organization. Contracts may specify documentation protection requirements.

## Implementation guidance

No content available.

## CSF 2.0 subcategories

- [GV.OC-02](/md/csf/GV.OC-02.md) — Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered
- [GV.OC-05](/md/csf/GV.OC-05.md) — Outcomes, capabilities, and services that the organization depends on are understood and communicated
- [GV.SC-02](/md/csf/GV.SC-02.md) — Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally
- [GV.SC-05](/md/csf/GV.SC-05.md) — Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
- [GV.SC-06](/md/csf/GV.SC-06.md) — Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships
- [GV.SC-09](/md/csf/GV.SC-09.md) — Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle
- [GV.SC-10](/md/csf/GV.SC-10.md) — Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement
- [ID.AM-08](/md/csf/ID.AM-08.md) — Systems, hardware, software, services, and data are managed throughout their life cycles
- [ID.IM-01](/md/csf/ID.IM-01.md) — Improvements are identified from evaluations
- [ID.IM-02](/md/csf/ID.IM-02.md) — ID.IM-02
- [ID.IM-03](/md/csf/ID.IM-03.md) — Improvements are identified from execution of operational processes, procedures, and activities
- [ID.RA-09](/md/csf/ID.RA-09.md) — The authenticity and integrity of hardware and software are assessed prior to acquisition and use

## Related controls

- [AT-3](/md/controls/AT-3.md)
- [SA-2](/md/controls/SA-2.md)
- [SA-3](/md/controls/SA-3.md)
- [SA-4](/md/controls/SA-4.md)
- [SA-5](/md/controls/SA-5.md)
- [SA-8](/md/controls/SA-8.md)
- [SA-9](/md/controls/SA-9.md)
- [SA-10](/md/controls/SA-10.md)
- [SA-15](/md/controls/SA-15.md)
- [SR-6](/md/controls/SR-6.md)
- [SR-9](/md/controls/SR-9.md)
- [SR-10](/md/controls/SR-10.md)
- [SR-11](/md/controls/SR-11.md)

---

Derived from official NIST publications (NIST SP 800-53 Rev 5 and NIST CSF 2.0). nistcontrols.com is not affiliated with NIST.