NIST 800-53 r5 · Controls catalogue · Family SR
SR-6Supplier Assessments and Reviews
Assess and review the supply chain-related risks associated with suppliers or contractors and the system, system component, or system service they provide {{ insert: param, sr-06_odp }}.
Last updated: 14 October 2026 20:41 UTC
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (7)AI-assisted
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-798 | Use of Hard-coded Credentials | 2,100+ | Supplier risk reviews identify and discourage hard-coded credentials in delivered products or services. |
CWE-321 | Use of Hard-coded Cryptographic Key | 300+ | Assessments can uncover and prevent suppliers from shipping components that contain hard-coded cryptographic keys. |
CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | 300+ | Supplier assessments directly reduce the likelihood of incorporating functionality from untrusted third-party control spheres. |
CWE-494 | Download of Code Without Integrity Check | 200+ | Supply-chain reviews verify that suppliers implement integrity checks before code or components are accepted. |
CWE-259 | Use of Hard-coded Password | 200+ | Reviews of supplier deliverables reduce the chance that hard-coded passwords are introduced into the system. |
CWE-506 | Embedded Malicious Code | 100+ | Reviews of suppliers and their deliverables can detect or deter introduction of embedded malicious code. |
CWE-1104 | Use of Unmaintained Third Party Components | 31 | Assessments evaluate supplier maintenance practices, lowering exposure to unmaintained third-party components. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2026-85469 | 5.7 | 8.0 | 0.0052 | partial |
CVE-2026-67275 | 4.2 | 5.3 | 0.0030 | good |
CVE-2025-32800 UPD | 7.4 | 9.8 | 0.0065 | good |
CVE-2024-3313 UPD | 6.2 | 8.4 | 0.0026 | good |
CVE-2024-28042 UPD | 6.1 | 8.4 | 0.0021 | good |
CVE-2024-26024 UPD | 6.1 | 8.4 | 0.0021 | good |
CVE-2026-47619 | 5.2 | 6.6 | 0.0077 | good |