Attachment 2: USDASecurityContractLanguage

C-SCRM Contract Language

USDA Cyber Supply Chain
Risk Management

(C-SCRM)

Contract Language
Version 1.0
Approved: Nov 04, 2020

C-SCRM Contract Language

Document Control Information
Version #

Author

Revision
Date

Approval
Date

Description of change

1.0

ISC SMD

10/28/2020

11/04/2020

Initial Document

The information contained herein is property of USDA OCIO. Unauthorized reproduction or disclosure of this information in whole or in part is prohibited. Limit distribution accordingly

C-SCRM Contract Language

1.1

1.2

1.3

3.1

3.2

4 INFORMATION AND COMMUNICATIONS TECHNOLOGY (ICT) SUPPLY CHAIN RISK MANAGEMENT

4.1
Continuous Diagnostic and Mitigation (CDM) Approved Products List (APL) Supply Chain Risk

4.2

4.3

4.4

4.5

4.6

4.7

4.8

4.9

5.1

5.2

5.3

5.4

5.5

5.6

5.7

6.1

6.2

6.3

6.4

C-SCRM Contract Language

USDA CYBER SUPPLY CHAIN RISK MANAGEMENT (C-SCRM)

Cyber Supply Chain Risk Management (C-SCRM) is the process of taking strategic steps to identify, assess and mitigate supply chain risk to departmental and agency information systems, system components and associated services based on analysis of the criticality of system components, services and functions. It covers the entire life cycle of a system (including design, development, distribution, deployment, acquisition, maintenance, and destruction) as supply chain threats and vulnerabilities may intentionally or unintentionally compromise information technology (IT) systems with operational technology (OT) systems (IT/OT) product or service at any stage.

IMPORTANT:

•

•

Program offices/CORs shall ensure the appropriate Cybersecurity SCRM language is included in requirements documents (PWS, SOW, SOO) and incorporated into the resultant contract action.
The content of this document is applicable to IT or security related contracts.

C-SCRM contract language is in support the latest publication of: •
•
•
•
•
•
•

USDA DR 3540-003 – USDA Security Assessment and Authorization (A&A) Policy, Federal Acquisition Supply Chain Security Act 2018,
NIST SP 800-161 - Supply Chain Risk Management Practices for Federal Information Systems and Organizations,
NIST SP 800-37 - Risk Management Framework for Information Systems and Organizations, NIST Cyber Supply Change Risk Management Program,
NIST SP 800-39, Managing Information Security Risk and, NIST 800-88 - Guidelines for Media Sanitization.

1.1 USDA SCRM Policy

In line with its federal obligations, the United States Department of Agriculture (USDA) commits itself through the IT Security Strategy and the Information Security Program (SSISP) Policy (in draft)