The National Institute of Standards and Technology has announced the release of Special Publication 800-18r2, a revision that expands the guidelines for security, privacy and cybersecurity supply chain risk management system plans.
Consolidating Security, Privacy and Supply Chain Risk Management
According to the initial public draft issued Wednesday, these system plans gather all critical information and serve as a centralized point of reference for assets and individuals safeguarded within an authorization boundary and interconnected systems. These centralized system plans also contain system and risk management decisions and the responsible individuals. The consolidated information on risk management decisions includes details on data creation, collection, dissemination, utilization, storage and disposal. They also include internal and external environments of operation, system components, data flows and controls for managing risks.
Key Revisions
The revised guideline details include enhanced guidance on developing system plans, insights into the development of system plans, revised system plan elements addressing security, privacy and cybersecurity supply chain risks, and considerations for the automated generation and maintenance of system plans using information management tools.
The draft includes supplemental materials such as system plan example outlines and updated roles and responsibilities related to system plan development.
Comments on the draft will be accepted until July 30.
