Information Systems Supply Chain Risk Management

BLINN COLLEGE ADMINISTRATIVE REGULATIONS MANUAL

SUBJECT: Information Systems Supply Chain Risk Management

EFFECTIVE DATE: July 20, 2023; amended September 19, 2023

BOARD POLICY REFERENCE: CS

PURPOSE

Develop policies and procedures for information system supply chain risk management.

PROCESS

Supply Chain Risk Management Policy and Procedures (MA-01)

The College District

  1. Develops, documents, and disseminates to information system owners:
    1. A supply chain risk management policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
    2. Procedures to facilitate the implementation of the supply chain risk management policy and associated supply chain risk management controls; and
  2. Reviews and updates the current:
    1. Supply chain risk management policy biennially; and
    2. Supply chain risk management procedures annually.

Supply Chain Risk Management Plan (SR-02)

The College District

  1. Develops a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations, and disposal of the information systems, components or system services.
  2. Implement the supply chain risk management plan consistently across the organization; and
  3. Review and update the supply chain risk management plan as required, to address threats, organizational or environmental changes.

Supply Chain Controls and Processes (SR-03)

The College District

  1. Establish a process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes of information systems in coordination with CISO and information system owners;
  2. Employ the following supply chain controls to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events: TX-RAMP; and
  3. Document the selected and implemented supply chain processes and controls in the TX-RAMP Questionnaire.

Acquisition Strategies, Tools and Methods (SR-05)

The College District

Employs the following acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks: TX-RAMP,

Notification Agreements (SR-08)

Establish agreements and procedures with entities involved in the supply chain for the system, system component, or system service for the: notification of supply chain compromises; results of assessments or audits; Using:

  1. Vulnerability scanning;
  2. Vendor notifications;
  3. MS-ISAC, TX-ISAO notifications; and
  4. Other publications

Component Disposal (SR-12)

Dispose of organization-defined data, documentation, tools, or system components using media protection or equivalent methods.