{"id":1906,"date":"2024-08-27T16:41:23","date_gmt":"2024-08-27T16:41:23","guid":{"rendered":"https:\/\/www.tarleton.edu\/security-controls-catalog\/?page_id=1906"},"modified":"2024-09-04T18:06:22","modified_gmt":"2024-09-04T18:06:22","slug":"sr-1-supply-chain-risk-management-policy-and-procedures","status":"publish","type":"page","link":"https:\/\/www.tarleton.edu\/security-controls-catalog\/supply-chain-risk-management-sr\/sr-1-supply-chain-risk-management-policy-and-procedures\/","title":{"rendered":"SR-1: Supply Chain Risk Management \u2013 Policy and Procedures"},"content":{"rendered":"\n

SR-1: Supply Chain Risk Management \u2013 Policy and Procedures<\/h1>\n\n\n\n
<\/div>\n\n\n\n

NIST Baseline: <\/strong>Low <\/h2>\n\n\n\n

DIR Required By:<\/strong>  07\/20\/2023 <\/h2>\n\n\n\n

Review Date: \u00a0<\/strong>08\/22\/2024\u00a0<\/h2>\n\n\n\n
\n\n\n\n

Purpose – <\/strong> <\/h3>\n\n\n\n

The Supply Chain Risk Management Policy and associated controls document the minimum standards required to manage risks associated with using information resources from external providers. Requirements are defined for supply chain risk management, acquisition, notification agreements, and component disposal.  <\/p>\n\n\n\n

\n\n\n\n

Scope and Roles – <\/strong> <\/h3>\n\n\n\n

This policy applies to information resources owned or managed by Tarleton. The intended audience includes all involved in hiring and personnel management, the Tarleton Chief Information Officer (CIO), Chief Information Security Officer (CISO), and information resource owners and custodians. <\/p>\n\n\n\n

\n\n\n\n

Compliance – <\/strong> <\/h3>\n\n\n\n

Supply Chain Risk Management controls are implemented to ensure compliance with the Texas Department of Information Resources (DIR) Security Control Standards Catalog as required by Title 1 Texas Administrative Code \u00a7202.76<\/a> and Texas A&M University System Regulation 29.01.03, Information Security<\/a>.  <\/p>\n\n\n\n

\n\n\n\n

Implementation – <\/strong> <\/h3>\n\n\n\n