A formal document that describes the implementations, requirements, constraints, and implications of cybersecurity supply chain risk management (C‑SCRM) controls selected for an information system or environment of operation that work in collaboration with the C‑SCRM strategy, policies, and implementation plan to provide a systematic and holistic approach to cybersecurity supply chain risk management across an enterprise. The C‑SCRM plan may be integrated with the system privacy and security plans into one consolidated document.
Sources:
NIST SP 800-18r2