Get help →
Home›Frameworks›Defense, Supply Chain & NIST Catalog

Defense, Supply Chain & NIST Catalog

12 standards, regulations and schemes in this family. A defense, supply chain or NIST catalog document, usually referenced by another obligation rather than assessed on its own. Each page explains what it is, who has to follow it, what to write down, and who checks it.

Share
Ad from the publisher
Policy  Acknowledgment  Proof
AcknowledgedSecurity policy v2by name, on record
Flowdown Handledwith AllyMatter
Flow It Down the Modern WayEvery policy a prime or a NIST catalog makes you write, acknowledged
01
Approve it, lock the version
Non-author approval, obsolete copies blocked
02
Every cleared employee on record
Who read which version, and when
03
Export the trail for the assessor
From $29/mo, 20 editors, unlimited staff (published)
See how it works →Pricing →

What is in this family

A defense, supply chain or NIST catalog document, usually referenced by another obligation rather than assessed on its own. Typically assessed by: level 1 and some Level 2 requirements are self-assessed and affirmed; Varies by component: self-assessment and affirmation; None. Most asked about here: DFARS, DoD compliance requirements, Microsoft SSPA DPR.

DFARSLevel 1 and some Level 2 requirements are self-assessed and affirmed. Level 2 certification assessments are…DoD compliance requirementsVaries by component: self-assessment and affirmation (FAR 52.204-21, CMMC Level 1), C3PAOs (CMMC Level 2)…Microsoft SSPA DPRIndependent assessors chosen by the supplier from firms meeting Microsoft's qualification guidance, which…NIST IR 8286DNone.NIST SP 800-161None for the publication itself; SR controls derived from it are assessed within FedRAMP (3PAOs), FISMA…NIST SP 800-218None. Self-attestation by the software producer's senior executive; agencies may accept a third-party…NIST SP 800-30None for the document itself. Risk assessments produced with it are reviewed by whichever assessor governs…NIST SP 800-34None for the document itself; contingency plans built on it are reviewed by the assessor of the parent…NIST SP 800-37Independent control assessors: agency or contracted assessment teams for FISMA systems, FedRAMP-recognized…NIST SP 800-39None.NIST SP 800-53None for the catalog itself. Within adopting programs: FedRAMP-recognized 3PAOs for cloud services, agency…NIST SP 800-61None for the document itself; incident response capabilities built on it are examined within parent programs…

Get told when Defense, Supply Chain & NIST Catalog standards change

One email when any of the Defense, Supply Chain & NIST Catalog standards on this site changes. Nothing else.

No spam, and we never sell your address or give it to anyone. Double opt-in, and an unsubscribe link in every email. Subscribing accepts the Terms and Privacy Policy. Follow more than this →

Need a hand implementing it?

Find a Consultant for Defense, Supply Chain & NIST Catalog: 12 Standards

Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.

Get help →Advertise Here

From the publisher

Keep Your Written Policies in One Place

Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.

See how AllyMatter works ↗From $29/mo, 20 editors, unlimited staff

About this data

Pages on this site are compiled by AllyMatter and checked against one or more sources, two or more where available. Each record shows its stage and date. Nothing here is legal, audit or tax advice, and policyandcompliance.com and AllyMatter, Inc. accept no responsibility for errors or for decisions made on it. Read the source, then decide.
How we compile and verify →

Think something is wrong?

[email protected]
Tell us the page and what you found. We check it against the source and fix it.

Want to advertise here?

[email protected]
Consultant listings, tool listings, press releases and the primary spot, flat fee, paid in advance. Prices and rules · Design examples · Press releases.