🏛️NIST 800-53 SR-3Rule: NIST-SR-003high

Supply Chain Controls and Processes

Description

Establish a process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes.

⚠️ Risk Impact

Supply chain attacks (SolarWinds Sunburst, MOVEit, Codecov, dependency confusion) are the dominant 2023-2025 breach vector. Without supply-chain controls, your security depends on every vendor's security.

🔍 How EchelonGraph Detects This

NIST-SR-003Automated scanner rule

EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected cloud accounts. Violations are flagged as high-severity findings with remediation guidance.

🔧 Remediation

Vendor security assessment (annual). Software Bill of Materials (SBOM) per artifact. Dependency-pinning + signature verification (cosign). CI/CD integrity (SLSA framework). Continuous SBOM scanning.

💀 Real-World Attack Scenario

SolarWinds Sunburst (Dec 2020): SolarWinds' build system was compromised, malicious code inserted into Orion updates, shipped to 18,000 customers. Even mature security organizations were affected. Recovery cost industry-wide: $100B+. SR-3 deficiency: 'no controls on the integrity of downstream vendor-supplied code'.

💰 Cost of Non-Compliance

Supply chain breach: avg cost $4.55M (IBM 2024). SolarWinds: $100B industry-wide. MOVEit: $12B. Dependency-confusion incidents: avg $890K each (Snyk State of Supply Chain 2024).

📋 Audit Questions

  • 1.Show your SBOM for the top product.
  • 2.What is the vendor security assessment cadence?
  • 3.How are dependencies pinned and verified?
  • 4.Show last detected supply-chain risk and remediation.

🎯 MITRE ATT&CK Mapping

T1195 — Supply Chain CompromiseT1195.002 — Compromise Software Supply Chain

⚡ Common Pitfalls

  • ⛔Trusting vendor SOC 2 without reading the report
  • ⛔SBOM produced but not scanned continuously against CVE feeds
  • ⛔Dependency-pinning by tag (mutable) rather than hash (immutable)

📈 Business Value

Supply-chain controls are now the dominant security investment. The frameworks (SLSA, OpenSSF, NIST SP 800-218) didn't exist in 2020; in 2024 they're table stakes.

⏱️ Effort Estimate

Manual

60-120 hours SBOM + vendor risk program setup

With EchelonGraph

EchelonGraph maintains SBOM + supply-chain CVE correlation continuously

🔗 Cross-Framework References

SOC2-CC9.2ISO27001-A.5.19MITRE_ATLAS-AML.T0010

Automate NIST 800-53 SR-3 compliance

EchelonGraph continuously monitors this control across all your cloud accounts.

Start Free →