Supply Chain Cyber Security Risk Management Plan

SOP-SC-004: Supply Chain Cybersecurity Risk Management Plan (SCRMP)

1. Document Control Block

---

2. Executive Summary & Scope

This SOP establishes the operational framework for identifying, assessing, and mitigating cyber risks originating from third-party vendors, service providers, and software supply chains.

Regulatory Alignment: NIST SP 800-161 (Supply Chain Risk Management Practices), ISO/IEC 27001:2022 (A.5.19-A.5.23), and GDPR/CCPA data integrity mandates. Operational Boundary: Extends from vendor onboarding and software procurement to continuous monitoring and sunsetting of external digital dependencies.

---

3. Prerequisites & Tool Requirements

• Access Requirements: Administrator access to Governance, Risk, and Compliance (GRC) platform (e.g., OneTrust, Archer, or internal TR-RiskDB).
• Tooling:
  • BitSight/SecurityScorecard: Real-time external security rating monitoring.
  • Software Bill of Materials (SBOM) Analyzer: Dependency-Check or Snyk integration for software assets.
  • TR-Vetting Portal: Internal vendor risk assessment workflow.
• Certification Requirements: Personnel must hold C-TPAT, CISSP, or CISM credentials for oversight approval.

---

4. Roles & Responsibilities (RACI Matrix)

(R: Responsible, A: Accountable, C: Consulted, I: Informed)

---

5. Step-by-Step Operational Procedure

Phase I: Onboarding & Risk Identification

• Conduct inherent risk assessment using the TR-RiskDB weighted rubric.
• Require submission of Type 2 SOC 2 reports and ISO 27001 certifications.
• Mandate the provision of a machine-readable SBOM (CycloneDX/SPDX format) for software assets.

Phase II: Continuous Monitoring

• Configure BitSight alerts for any "Critical" or "High" security rating drops.
• Execute automated monthly vulnerability scans against web-accessible vendor infrastructure.
• Audit vendor-provided access logs quarterly to ensure Least Privilege compliance.

Phase III: Incident Escalation & Mitigation

• Trigger the "Supply Chain Incident Response Protocol" upon detection of a vendor breach.
• Isolate compromised vendor network segments using Zero Trust Network Access (ZTNA) policies.
• Execute formal notification to Data Privacy Officers within 24 hours of suspected data exfiltration.

---

6. Quality Assurance & Verification Criteria

• Tolerance Thresholds:
  • Zero tolerance for "Critical" vulnerabilities > 14 days old.
  • SOC 2 reports must be < 12 months old; gaps require a Bridge Letter signed by vendor CFO.
• Acceptance Benchmarks:
  • 100% of high-risk vendors must undergo an annual penetration test review.
  • 95% SBOM coverage for all production software applications.
• Audit Checklist:
  • Are all vendor contracts currently active with the "Cybersecurity Addendum"?
  • Is the vendor's SBOM stored in the central registry?
  • Are there open tickets for high-risk findings?

---

7. Practical Troubleshooting Scenarios

Scenario A: Vendor Refuses to Provide SBOM

• Failure: Vendor claims "Intellectual Property" protection to avoid disclosing component dependencies.
• Corrective Action: Escalate to Procurement/Legal. Initiate a "Security Equivalency Review," requiring the vendor to allow an independent 3rd-party code scan or provide a signed attestation of component security (e.g., VEX document) to bypass the SBOM block.

Scenario B: Security Rating Drops Below Threshold

• Failure: BitSight score drops from 750 to 600 due to a newly discovered CVE on the vendor's gateway.
• Corrective Action: Move vendor to "Quarantine" status. Block inbound/outbound traffic from the vendor to production environments. Issue a "30-Day Cure Period" notice. If not remediated, trigger exit strategy/contract termination.

Scenario C: Unauthorized Sub-processor Detected

• Failure: Audit reveals vendor has shared TR-data with a non-vetted sub-processor.
• Corrective Action: Immediate hold on all data transfers. Invoke "Right to Audit" clause. If sub-processor fails security screening, mandate immediate data deletion and enforce contractual penalty clauses.

---

Julian Vance
Chief Operations Architect
Template Registry