Supply chain risk management

// REQUIREMENTS

// INTENT

Know who is in your supply chain for the in-scope systems, assess the risk they bring, and flow requirements down where protected data flows down.

// WHAT A FIRST ASSESSMENT FINDS

Subcontractors receiving drawings with no clause attached and no questions asked.

// THE WORK

An inventory of who touches in-scope systems and data, flow-down language in subcontracts, and evidence that the process repeats.

// HOW WE CAN INTERPRET IT

// TEMPLATES FOR THIS FAMILY

• Shared responsibility matrix