Planisphere Download for Mac

Defense · C-SCRM

C-SCRM for defense AI workflows

C-SCRM in defense AI workflows: what compliance requires, who asks for evidence, and the records to keep.

Legal forceGuidance for federal agencies; reaches suppliers through contracts
Applies from5 May 2022
SectorDefense
Checked21 Oct 2026

01 / The rule

What C-SCRM requires

Federal agencies managing cybersecurity risk in the products and services they acquire, and by extension their suppliers; usable by any organization.

  1. 01Set a C-SCRM strategy, policy and implementation plan at enterprise, mission and system levels.
  2. 02Assess supply chain risk for products and services before and during acquisition.
  3. 03Apply and tailor supply chain controls (SP 800-53 SR family and enhanced overlays) to systems.
  4. 04Flow C-SCRM requirements into supplier contracts and monitor supplier compliance.
  5. 05Maintain visibility into components, provenance and suppliers, and respond to supply chain incidents.

02 / In this sector

In a defense AI workflow

Third-party models, training data, AI APIs and AI-enabled software are supply chain elements under this guidance. It contains no AI-specific controls.

Usually asked by

Program office leads and ATO-package owners.

Named alongside

NIST AI RMF · DoW RAI · OMB M-25-21.

Sector pagePlanisphere for defense

03 / Records

Records to keep

  1. 01C-SCRM strategy, policy and implementation plan
  2. 02Supplier risk assessments and completed scoping questionnaires
  3. 03Contract clauses flowing down supply chain requirements
  4. 04Component inventories, SBOMs and provenance records

Optional evidence · where Planisphere fits

Keep a record anyone can check

When your team meets a duty, Planisphere can seal the event it reports as a receipt.

01 · Your teamRecord the event

A disclosure shown, a review signed, a model change approved: the event your system reports.

02 · PlanisphereSeal it

The event becomes a sealed receipt, dated and attributed to whoever is signed in.

03 · AnyoneCheck it

Paste the receipt into Verify. No account or key.

A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.

SOURCES

Go back to the source

RELATED

Related: C-SCRM: the full guide · C-SCRM for medicine · C-SCRM for law · C-SCRM for education