Framework · ARC-AMPE
DE-Entity Mandatory Baseline
Volume II — SSPP DE-Entity Mandatory Baseline (v1.0) · NIST SP 800-53 Rev 5 tailoring (CMS ARC-AMPE) · supersedes MARS-E · compliance date 2026-03-04
Every control below is bound to the shared evidence spine; state reflects the current demo tenant.
Version history & changes41 added · 26 removed · 76 renumbered or retitled since MARS-E 2.2BASELINE2550ba9a · 2025-04-10
308
Mandatory controls
254
Evidenced
35
Scheduled
19
Gaps
Baseline evidenced
82%
ACAccess Control46 controls · 18 base · 28 enh38/46
| AC-01 | Policy and Procedures | Base | gap |
| AC-02 | Account Management | Base | evidenced |
| AC-02(01) | Automated System Account Management | Enh · AC-02 | scheduled |
| AC-02(02) | Automated Temporary and Emergency Account Management | Enh · AC-02 | gap |
| AC-02(03) | Disable Accounts | Enh · AC-02 | evidenced |
| AC-02(04) | Automated Audit Actions | Enh · AC-02 | evidenced |
| AC-02(05) | Inactivity Logout | Enh · AC-02 | evidenced |
| AC-02(07) | Privileged User Accounts | Enh · AC-02 | evidenced |
| AC-02(12) | Account Monitoring for Atypical Usage | Enh · AC-02 | evidenced |
| AC-02(13) | Disable Accounts for High-Risk Individuals | Enh · AC-02 | evidenced |
| AC-03 | Access Enforcement | Base | evidenced |
| AC-03(14) | Individual Access | Enh · AC-03 | evidenced |
| AC-04 | Information Flow Enforcement | Base | evidenced |
| AC-05 | Separation of Duties | Base | evidenced |
| AC-06 | Least Privilege | Base | gap |
| AC-06(01) | Authorize Access to Security Functions | Enh · AC-06 | evidenced |
| AC-06(02) | Non-privileged Access for Nonsecurity Functions | Enh · AC-06 | scheduled |
| AC-06(05) | Privileged Accounts | Enh · AC-06 | evidenced |
| AC-06(07) | Review of User Privileges | Enh · AC-06 | evidenced |
| AC-06(09) | Log Use of Privileged Functions | Enh · AC-06 | evidenced |
| AC-06(10) | Prohibit Non-privileged Users from Executing Privileged Functions | Enh · AC-06 | evidenced |
| AC-07 | Unsuccessful Logon Attempts | Base | evidenced |
| AC-08 | System Use Notification | Base | evidenced |
| AC-10 | Concurrent Session Control | Base | scheduled |
| AC-11 | Device Lock | Base | evidenced |
| AC-12 | Session Termination | Base | evidenced |
| AC-12(01) | User-Initiated Logouts | Enh · AC-12 | scheduled |
| AC-12(02) | Termination Message | Enh · AC-12 | evidenced |
| AC-12(03) | Timeout Warning Message | Enh · AC-12 | evidenced |
| AC-14 | Permitted Actions Without Identification or Authentication | Base | evidenced |
| AC-17 | Remote Access | Base | evidenced |
| AC-17(01) | Monitoring and Control | Enh · AC-17 | evidenced |
| AC-17(02) | Protection of Confidentiality and Integrity Using Encryption | Enh · AC-17 | evidenced |
| AC-17(03) | Managed Access Control Points | Enh · AC-17 | evidenced |
| AC-17(04) | Privileged Commands and Access | Enh · AC-17 | evidenced |
| AC-17(09) | Disconnect or Disable Access | Enh · AC-17 | evidenced |
| AC-18 | Wireless Access | Base | evidenced |
| AC-18(01) | Authentication and Encryption | Enh · AC-18 | evidenced |
| AC-18(03) | Disable Wireless Networking | Enh · AC-18 | evidenced |
| AC-19 | Access Control for Mobile Devices | Base | evidenced |
| AC-19(05) | Full Device and Container-based Encryption | Enh · AC-19 | evidenced |
| AC-20 | Use of External Systems | Base | evidenced |
| AC-20(01) | Limits on Authorized Use | Enh · AC-20 | evidenced |
| AC-20(02) | Portable Storage Devices — Restricted Use | Enh · AC-20 | evidenced |
| AC-21 | Information Sharing | Base | evidenced |
| AC-22 | Publicly Accessible Content | Base | scheduled |
ATAwareness and Training9 controls · 4 base · 5 enh7/9
| AT-01 | Policy and Procedures | Base | evidenced |
| AT-02 | Literacy Training and Awareness | Base | evidenced |
| AT-02(02) | Insider Threat | Enh · AT-02 | evidenced |
| AT-02(03) | Social Engineering and Mining | Enh · AT-02 | evidenced |
| AT-02(04) | Suspicious Communications and Anomalous System Behavior | Enh · AT-02 | evidenced |
| AT-02(05) | Advanced Persistent Threat | Enh · AT-02 | evidenced |
| AT-03 | Role-Based Training | Base | scheduled |
| AT-03(05) | Processing Personally Identifiable Information | Enh · AT-03 | evidenced |
| AT-04 | Training Records | Base | gap |
AUAudit and Accountability18 controls · 12 base · 6 enh14/18
| AU-01 | Policy and Procedures | Base | evidenced |
| AU-02 | Event Logging | Base | evidenced |
| AU-03 | Content of Audit Records | Base | scheduled |
| AU-03(01) | Additional Audit Information | Enh · AU-03 | evidenced |
| AU-03(03) | Limit Personally Identifiable Information Elements | Enh · AU-03 | gap |
| AU-04 | Audit Log Storage Capacity | Base | evidenced |
| AU-05 | Response to Audit Logging Processing Failures | Base | evidenced |
| AU-06 | Audit Record Review, Analysis, and Reporting | Base | gap |
| AU-06(01) | Automated Process Integration | Enh · AU-06 | evidenced |
| AU-06(03) | Correlate Audit Record Repositories | Enh · AU-06 | evidenced |
| AU-07 | Audit Record Reduction and Report Generation | Base | evidenced |
| AU-07(01) | Automatic Processing | Enh · AU-07 | evidenced |
| AU-08 | Time Stamps | Base | evidenced |
| AU-09 | Protection of Audit Information | Base | evidenced |
| AU-09(04) | Access by Subset of Privileged Users | Enh · AU-09 | evidenced |
| AU-10 | Non-Repudiation | Base | evidenced |
| AU-11 | Audit Record Retention | Base | evidenced |
| AU-12 | Audit Record Generation | Base | scheduled |
CAAssessment, Authorization, and Monitoring12 controls · 8 base · 4 enh11/12
| CA-01 | Policies and Procedures | Base | evidenced |
| CA-02 | Control Assessments | Base | evidenced |
| CA-02(01) | Independent Assessors | Enh · CA-02 | gap |
| CA-03 | Information Exchange | Base | evidenced |
| CA-05 | Plan of Action and Milestones | Base | evidenced |
| CA-06 | Authorization | Base | evidenced |
| CA-07 | Continuous Monitoring | Base | evidenced |
| CA-07(01) | Independent Assessment | Enh · CA-07 | evidenced |
| CA-07(04) | Risk Monitoring | Enh · CA-07 | evidenced |
| CA-08 | Penetration Testing | Base | evidenced |
| CA-08(01) | Independent Penetration Testing Agent or Team | Enh · CA-08 | evidenced |
| CA-09 | Internal System Connections | Base | evidenced |
CMConfiguration Management25 controls · 13 base · 12 enh20/25
| CM-01 | Policy and Procedures | Base | evidenced |
| CM-02 | Baseline Configuration | Base | scheduled |
| CM-02(03) | Retention of Previous Configurations | Enh · CM-02 | evidenced |
| CM-03 | Configuration Change Control | Base | evidenced |
| CM-03(02) | Testing, Validation, and Documentation of Changes | Enh · CM-03 | evidenced |
| CM-04 | Impact Analyses | Base | evidenced |
| CM-04(01) | Separate Test Environments | Enh · CM-04 | evidenced |
| CM-04(02) | Verification of Controls | Enh · CM-04 | evidenced |
| CM-05 | Access Restrictions for Change | Base | evidenced |
| CM-05(01) | Automated Access Enforcement and Audit Records | Enh · CM-05 | evidenced |
| CM-05(05) | Privilege Limitation for Production and Operation | Enh · CM-05 | evidenced |
| CM-06 | Configuration Settings | Base | evidenced |
| CM-06(01) | Automated Management, Application, and Verification | Enh · CM-06 | evidenced |
| CM-07 | Least Functionality | Base | scheduled |
| CM-07(01) | Periodic Review | Enh · CM-07 | evidenced |
| CM-07(02) | Prevent Program Execution | Enh · CM-07 | scheduled |
| CM-07(05) | Authorized Software - Allow by Exception | Enh · CM-07 | gap |
| CM-08 | System Component Inventory | Base | evidenced |
| CM-08(01) | Updates During Installation and Removal | Enh · CM-08 | scheduled |
| CM-08(03) | Automated Unauthorized Component Detection | Enh · CM-08 | evidenced |
| CM-09 | Configuration Management Plan | Base | evidenced |
| CM-10 | Software Usage Restrictions | Base | evidenced |
| CM-11 | User-Installed Software | Base | evidenced |
| CM-12 | Information Location | Base | evidenced |
| CM-13 | Data Action Mapping | Base | evidenced |
CPContingency Planning16 controls · 7 base · 9 enh15/16
| CP-01 | Policy and Procedures | Base | evidenced |
| CP-02 | Contingency Plan | Base | evidenced |
| CP-02(01) | Coordinate with Related Plans | Enh · CP-02 | scheduled |
| CP-02(03) | Resume Missions and Business Functions | Enh · CP-02 | evidenced |
| CP-02(08) | Identify Critical Assets | Enh · CP-02 | evidenced |
| CP-03 | Contingency Training | Base | evidenced |
| CP-04 | Contingency Plan Testing | Base | evidenced |
| CP-04(01) | Coordinate with Related Plans | Enh · CP-04 | evidenced |
| CP-06 | Alternate Storage Site | Base | evidenced |
| CP-06(01) | Separation from Primary Site | Enh · CP-06 | evidenced |
| CP-06(03) | Accessibility | Enh · CP-06 | evidenced |
| CP-09 | System Backup | Base | evidenced |
| CP-09(01) | Testing for Reliability and Integrity | Enh · CP-09 | evidenced |
| CP-09(08) | Cryptographic Protection | Enh · CP-09 | evidenced |
| CP-10 | System Recovery and Reconstitution | Base | evidenced |
| CP-10(02) | Transaction Recovery | Enh · CP-10 | evidenced |
IAIdentification and Authentication21 controls · 10 base · 11 enh17/21
| IA-01 | Policy and Procedures | Base | evidenced |
| IA-02 | Identification and Authentication (Organizational Users) | Base | evidenced |
| IA-02(01) | Multifactor Access to Privileged Accounts | Enh · IA-02 | evidenced |
| IA-02(02) | Multifactor Access to Non-Privileged Accounts | Enh · IA-02 | evidenced |
| IA-02(06) | Access to Accounts - Separate Device | Enh · IA-02 | scheduled |
| IA-02(08) | Access to Accounts - Replay Resistant | Enh · IA-02 | evidenced |
| IA-03 | Device Identification and Authentication | Base | evidenced |
| IA-04 | Identifier Management | Base | evidenced |
| IA-04(04) | Identify User Status | Enh · IA-04 | evidenced |
| IA-05 | Authenticator Management | Base | scheduled |
| IA-05(01) | Password-Based Authentication | Enh · IA-05 | evidenced |
| IA-05(06) | Protection of Authenticators | Enh · IA-05 | evidenced |
| IA-05(07) | Authenticator Management | No Embedded Unencrypted Static Authenticators | Enh · IA-05 | evidenced |
| IA-06 | Authenticator Feedback | Base | evidenced |
| IA-07 | Cryptographic Module Authentication | Base | evidenced |
| IA-08 | Identification and Authentication (Non-Organizational Users) | Base | evidenced |
| IA-08(02) | Identification and Authentication (Non-Organizational Users) |Acceptance of External Party Credentials | Enh · IA-08 | scheduled |
| IA-11 | Re-Authentication | Base | scheduled |
| IA-12 | Identity Proofing | Base | evidenced |
| IA-12(01) | Supervisor Authorization | Enh · IA-12 | evidenced |
| IA-12(03) | Identity Evidence Validation and Verification | Enh · IA-12 | evidenced |
IRIncident Response15 controls · 8 base · 7 enh12/15
| IR-01 | Policy and Procedures | Base | scheduled |
| IR-02 | Incident Response Training | Base | evidenced |
| IR-02(03) | Breach | Enh · IR-02 | evidenced |
| IR-03 | Incident Response Testing | Base | evidenced |
| IR-03(02) | Coordination with Related Plans | Enh · IR-03 | evidenced |
| IR-04 | Incident Handling | Base | evidenced |
| IR-04(03) | Continuity of Operations | Enh · IR-04 | evidenced |
| IR-04(06) | Insider Threats – Specific Capabilities | Enh · IR-04 | evidenced |
| IR-05 | Incident Monitoring | Base | evidenced |
| IR-06 | Incident Reporting | Base | scheduled |
| IR-06(01) | Automated Reporting | Enh · IR-06 | evidenced |
| IR-07 | Incident Response Assistance | Base | evidenced |
| IR-07(01) | Automation Support for Availability of Information and Support | Enh · IR-07 | evidenced |
| IR-08 | Incident Response Plan | Base | evidenced |
| IR-08(01) | Breaches | Enh · IR-08 | scheduled |
MAMaintenance12 controls · 6 base · 6 enh11/12
| MA-01 | Policy and Procedures | Base | evidenced |
| MA-02 | Controlled Maintenance | Base | evidenced |
| MA-03 | Maintenance Tools | Base | gap |
| MA-03(01) | Inspect Tools | Enh · MA-03 | evidenced |
| MA-03(02) | Inspect Media | Enh · MA-03 | evidenced |
| MA-03(03) | Prevent Unauthorized Removal | Enh · MA-03 | evidenced |
| MA-03(05) | Execution with Privilege | Enh · MA-03 | evidenced |
| MA-03(06) | Software Updates and Patches | Enh · MA-03 | evidenced |
| MA-04 | Nonlocal Maintenance | Base | evidenced |
| MA-04(01) | Logging and Review | Enh · MA-04 | evidenced |
| MA-05 | Maintenance Personnel | Base | evidenced |
| MA-06 | Timely Maintenance | Base | evidenced |
MPMedia Protection8 controls · 7 base · 1 enh7/8
| MP-01 | Policy and Procedures | Base | evidenced |
| MP-02 | Media Access | Base | evidenced |
| MP-03 | Media Marking | Base | evidenced |
| MP-04 | Media Storage | Base | evidenced |
| MP-05 | Media Transport | Base | scheduled |
| MP-06 | Media Sanitization | Base | evidenced |
| MP-06(01) | Review, Approve, Track, Document, and Verify | Enh · MP-06 | evidenced |
| MP-07 | Media Use | Base | evidenced |
PEPhysical and Environmental Protection9 controls · 8 base · 1 enh8/9
| PE-01 | Policy and Procedures | Base | evidenced |
| PE-02 | Physical Access Authorizations | Base | evidenced |
| PE-03 | Physical Access Control | Base | evidenced |
| PE-04 | Access Control for Transmission | Base | evidenced |
| PE-05 | Access Control for Output Devices | Base | evidenced |
| PE-06 | Monitoring Physical Access | Base | gap |
| PE-06(01) | Intrusion Alarms and Surveillance Equipment | Enh · PE-06 | evidenced |
| PE-08 | Visitor Access Records | Base | evidenced |
| PE-16 | Delivery and Removal | Base | evidenced |
PLPlanning6 controls · 5 base · 1 enh5/6
| PL-01 | Policy and Procedures | Base | evidenced |
| PL-02 | System Security and Privacy Plan | Base | scheduled |
| PL-04 | Rules of Behavior | Base | evidenced |
| PL-04(01) | Social Media and External Site / Application Usage Restrictions | Enh · PL-04 | evidenced |
| PL-08 | Security and Privacy Architectures | Base | evidenced |
| PL-11 | Baseline Tailoring | Base | evidenced |
PMProgram Management5 controls · 4 base · 1 enh4/5
| PM-04 | Plan of Action and Milestones Process | Base | evidenced |
| PM-05 | System Inventory | Base | evidenced |
| PM-05(01) | Inventory of Personally Identifiable Information | Enh · PM-05 | evidenced |
| PM-21 | Accounting of Disclosures | Base | evidenced |
| PM-25 | Minimization of PII Used in Testing, Training, and Research | Base | scheduled |
PSPersonnel Security8 controls · 8 base · 0 enh6/8
| PS-01 | Policy and Procedures | Base | evidenced |
| PS-02 | Position Risk Designation | Base | evidenced |
| PS-03 | Personnel Screening | Base | evidenced |
| PS-04 | Personnel Termination | Base | evidenced |
| PS-05 | Personnel Transfer | Base | gap |
| PS-06 | Access Agreements | Base | evidenced |
| PS-07 | External Personnel Security | Base | evidenced |
| PS-08 | Personnel Sanctions | Base | scheduled |
PTPersonally Identifiable Information Processing and Transparency10 controls · 6 base · 4 enh6/10
| PT-01 | Policy and Procedures | Base | evidenced |
| PT-02 | Authority to Process Personally Identifiable Information | Base | scheduled |
| PT-03 | Personally Identifiable Information Processing Purposes | Base | evidenced |
| PT-04 | Consent | Base | evidenced |
| PT-04(03) | Revocation | Enh · PT-04 | evidenced |
| PT-05 | Privacy Notice | Base | gap |
| PT-05(01) | Just-in-time Notice | Enh · PT-05 | evidenced |
| PT-05(02) | Privacy Act Statements | Enh · PT-05 | gap |
| PT-07 | Specific Categories of Personally Identifiable Information | Base | evidenced |
| PT-07(01) | Social Security Numbers | Enh · PT-07 | gap |
RARisk Assessment8 controls · 6 base · 2 enh7/8
| RA-01 | Policy and Procedures | Base | scheduled |
| RA-02 | Security Categorization | Base | evidenced |
| RA-03 | Risk Assessment | Base | evidenced |
| RA-05 | Vulnerability Monitoring and Scanning | Base | evidenced |
| RA-05(02) | Update Vulnerabilities to be Scanned | Enh · RA-05 | evidenced |
| RA-05(05) | Privileged Access | Enh · RA-05 | evidenced |
| RA-07 | Risk Response | Base | evidenced |
| RA-08 | Privacy Impact Assessments | Base | evidenced |
SASystem and Services Acquisition18 controls · 12 base · 6 enh16/18
| SA-01 | Policy and Procedures | Base | evidenced |
| SA-02 | Allocation of Resources | Base | evidenced |
| SA-03 | System Development Life Cycle | Base | scheduled |
| SA-04 | Acquisition Process | Base | evidenced |
| SA-04(01) | Functional Properties of Controls | Enh · SA-04 | evidenced |
| SA-04(02) | Design and Implementation Information for Security Controls | Enh · SA-04 | evidenced |
| SA-04(09) | Functions, Ports, Protocols, and Services in Use | Enh · SA-04 | evidenced |
| SA-05 | System Documentation | Base | evidenced |
| SA-08 | Security and Privacy Engineering Principles | Base | scheduled |
| SA-09 | External System Services | Base | evidenced |
| SA-09(05) | Processing, Storage, and Service Location | Enh · SA-09 | evidenced |
| SA-09(08) | Processing and Storage Location - U.S. Jurisdiction | Enh · SA-09 | evidenced |
| SA-10 | Developer Configuration Management | Base | evidenced |
| SA-11 | Developer Testing and Evaluation | Base | evidenced |
| SA-15 | Development Process, Standards, and Tools | Base | evidenced |
| SA-15(12) | Minimize Personally Identifiable Information | Enh · SA-15 | evidenced |
| SA-17 | Developer Security Architecture and Design | Base | evidenced |
| SA-22 | Unsupported System Components | Base | evidenced |
SCSystem and Communications Protection28 controls · 16 base · 12 enh23/28
| SC-01 | Policy and Procedures | Base | evidenced |
| SC-02 | Separation of System and User Functionality | Base | evidenced |
| SC-04 | Information in Shared System Resources | Base | evidenced |
| SC-05 | Denial-of-Service Protection | Base | evidenced |
| SC-07 | Boundary Protection | Base | evidenced |
| SC-07(03) | Access Points | Enh · SC-07 | evidenced |
| SC-07(04) | External Telecommunications Services | Enh · SC-07 | evidenced |
| SC-07(05) | Deny By Default — Allow By Exception | Enh · SC-07 | evidenced |
| SC-07(07) | Split Tunneling for Remote Devices | Enh · SC-07 | gap |
| SC-07(08) | Route Traffic to Authenticated Proxy Servers | Enh · SC-07 | evidenced |
| SC-07(12) | Host-Based Protection | Enh · SC-07 | gap |
| SC-07(18) | Fail Secure | Enh · SC-07 | evidenced |
| SC-7(24) | Boundary Protection | Personally Identifiable Information | Enh · SC-7 | evidenced |
| SC-7(29) | Boundary Protection | Separate Subnets to Isolate Functions | Enh · SC-7 | gap |
| SC-08 | Transmission Confidentiality and Integrity | Base | evidenced |
| SC-08(01) | Cryptographic Protection | Enh · SC-08 | evidenced |
| SC-08(02) | Pre- and Post-Transmission Handling | Enh · SC-08 | evidenced |
| SC-10 | Network Disconnect | Base | evidenced |
| SC-12 | Cryptographic Key Establishment and Management | Base | evidenced |
| SC-13 | Cryptographic Protection | Base | evidenced |
| SC-17 | Public Key Infrastructure Certificates | Base | evidenced |
| SC-18 | Mobile Code | Base | gap |
| SC-20 | Secure Name/Address Resolution Service (Authoritative Source) | Base | scheduled |
| SC-21 | Secure Name/Address Resolution Service (Recursive or Caching Resolver) | Base | evidenced |
| SC-22 | Architecture and Provisioning for Name/Address Resolution Service | Base | evidenced |
| SC-23 | Session Authenticity | Base | evidenced |
| SC-28 | Protection of Information At Rest | Base | evidenced |
| SC-28(01) | Cryptographic Protection | Enh · SC-28 | evidenced |
SISystem and Information Integrity30 controls · 14 base · 16 enh23/30
| SI-01 | Policy and Procedures | Base | evidenced |
| SI-02 | Flaw Remediation | Base | scheduled |
| SI-02(02) | Automated Flaw Remediation Status | Enh · SI-02 | evidenced |
| SI-02(06) | Removal of Previous Versions of Software and Firmware | Enh · SI-02 | scheduled |
| SI-03 | Malicious Code Protection | Base | evidenced |
| SI-04 | System Monitoring | Base | evidenced |
| SI-04(01) | System-Wide Intrusion Detection System | Enh · SI-04 | evidenced |
| SI-04(04) | Inbound and Outbound Communications Traffic | Enh · SI-04 | evidenced |
| SI-04(05) | System-Generated Alerts | Enh · SI-04 | evidenced |
| SI-04(23) | Host-Based Devices | Enh · SI-04 | evidenced |
| SI-05 | Security Alerts, Advisories, and Directives | Base | scheduled |
| SI-06 | Security and Privacy Function Verification | Base | evidenced |
| SI-07 | Software, Firmware, and Information Integrity | Base | evidenced |
| SI-07(01) | Integrity Checks | Enh · SI-07 | scheduled |
| SI-07(07) | Integration of Detection and Response | Enh · SI-07 | scheduled |
| SI-08 | Spam Protection | Base | gap |
| SI-08(02) | Automatic Updates | Enh · SI-08 | evidenced |
| SI-10 | Information Input Validation | Base | evidenced |
| SI-11 | Error Handling | Base | evidenced |
| SI-12 | Information Management and Retention | Base | evidenced |
| SI-12(01) | Limit Personally Identifiable Information Elements | Enh · SI-12 | evidenced |
| SI-12(02) | Minimize Personally Identifiable Information in Testing, Training, and Research | Enh · SI-12 | evidenced |
| SI-12(03) | Information Disposal | Enh · SI-12 | evidenced |
| SI-16 | Memory Protection | Base | evidenced |
| SI-18 | Personally Identifiable Information Quality Operations | Base | evidenced |
| SI-18(04) | Individual Requests | Enh · SI-18 | evidenced |
| SI-18(05) | Notice of Collection or Deletion | Enh · SI-18 | evidenced |
| SI-19 | De-Identification | Base | scheduled |
| SI-19(03) | Release | Enh · SI-19 | evidenced |
| SI-19(04) | Removal, Masking, Encryption, Hashing, or Replacement of Direct Identifiers | Enh · SI-19 | evidenced |
SRSupply Chain Risk Management4 controls · 3 base · 1 enh4/4
| SR-01 | Policy and Procedures | Base | evidenced |
| SR-02 | Supply Chain Risk Management Plan | Base | evidenced |
| SR-02(01) | Establish SCRM Team | Enh · SR-02 | evidenced |
| SR-03 | Supply Chain Controls and Processes | Base | evidenced |