SR-8—Notification Agreements
LOW
MODERATE
HIGH
>Control Description
Establish agreements and procedures with entities involved in the supply chain for the system, system component, or system service for the ☑notification of supply chain compromises; results of assessments or audits; [Assignment: organization-defined information].
>Cross-Framework Mappings
>Programmatic Queries
Beta
Related Services
Amazon SNS
AWS Health
Amazon EventBridge
CLI Commands
List SNS topics for notifications
aws sns list-topicsList AWS Health events (service incidents)
aws health describe-events --filter '{"eventTypeCategories":["issue"]}'List EventBridge rules for supply chain alerts
aws events list-rules --name-prefix securityList SNS subscriptions for notification routing
aws sns list-subscriptions>Supplemental Guidance
The establishment of agreements and procedures facilitates communications among supply chain entities. Early notification of compromises and potential compromises in the supply chain that can potentially adversely affect or have adversely affected organizational systems or system components is essential for organizations to effectively respond to such incidents. The results of assessments or audits may include open-source information that contributed to a decision or result and could be used to help the supply chain entity resolve a concern or improve its processes.
>Related Controls
>Assessment Interview Topics
Questions assessors commonly ask
Process & Governance:
- •What supply chain risk management policies address SR-8?
- •Who is responsible for managing supply chain risks?
- •How do you assess and monitor risks from suppliers, vendors, and contractors?
Technical Implementation:
- •What processes ensure that supply chain components meet security requirements?
- •How do you verify the authenticity and integrity of acquired components?
- •What controls prevent counterfeit or malicious components from entering your supply chain?
- •How do you track and verify the provenance of system components?
Evidence & Documentation:
- •Can you provide supply chain risk assessments?
- •What documentation demonstrates supplier compliance with security requirements?
- •Where do you maintain records of supplier assessments and component provenance?
- •Can you show component inventory and validation records?
Ask AI
Configure your API key to use AI features.