Supplier Reviews
Medium Risk
Easy
Low Cost
SA-12(2) (Supplier Reviews) enhances base SA-12 within the NIST System and Services Acquisition family. Base SA-12 sets the foundational expectation; this enhancement adds specificity: This enhancement strengthens SA-12 with requirements for supplier reviews on systems and services that create, receive, maintain, or transmit ePHI. Covered entities and business associates apply it to system acquisition, SDLC, developer testing, supply chain, and engineering principles for EHR, interfaces, and clinical SaaS. Note: SA-12 Supply Chain Protection was withdrawn in NIST SP 800-53 Rev. 5 and incorporated into the SR family; this KB entry preserves SA-12(2) (Supplier Reviews) for continuity and maps practice to SR controls.
Control Objective
Implement Supplier Reviews so acquisition, development, and engineering safeguards operate consistently on systems handling ePHI, with measurable evidence for HIPAA and NIST assessments.
Implementation Guidance
- Map SA-12(2) to in-scope acquired/built systems (EHR, imaging, lab, pharmacy, billing, portals, interfaces, identity).\n2. Translate “Supplier Reviews” into contract clauses, SDLC gates, architecture patterns, or verification steps with named owners.\n3. Prefer enforceable pipeline and configuration controls over checklist-only assurances where feasible.\n4. Include BA/OEM obligations and evidence deliverables when vendors develop or host ePHI components.\n5. Integrate with change, release, and incident processes so clinical go-lives do not bypass the enhancement.\n6. Retain design packages, test results, SBOMs, and tickets as audit evidence.\n7. Re-validate after major version upgrades — vendors often reset secure defaults.\n8. Review exceptions quarterly; expire “temporary” acquisition waivers that leave ePHI exposed.
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
Best Practices
- Name an owner for SA-12(2) in the SSP / acquisition control matrix.\n- Put security and privacy requirements in RFPs and BA agreements before award.\n- Measure coverage: percent of ePHI systems where the enhancement’s gates actually run.\n- Keep a one-page evidence pack (design excerpt + test sample + last review) ready.\n- Map withdrawn SA-12 intent to SR-family controls when using Rev. 5 baselines.\n- Re-test after EHR and interface platform upgrades.
Common Gaps & Violations
- Policy cites SA-12(2) but builds/procurements of ePHI systems show no enforcement of supplier reviews.\n- Vendors self-attest without artifacts (tests, SBOMs, design docs).\n- Clinical systems and interfaces excluded “because the OEM manages security.”\n- Permanent acquisition waivers with no residual-risk acceptance.\n- Title left as placeholder (“Enhanced …”) with empty use cases.
Required Documentation
- Procedure/standard for Supplier Reviews (SA-12(2))\n- RFP/contract security exhibits and BA terms\n- SDLC gate definitions and sample evidence\n- Architecture or SBOM / integrity verification records as applicable\n- Exception register with owners and expiry
How to Test & Validate
- Sample a recent acquisition or release touching ePHI; verify supplier reviews evidence exists.\n2. Confirm a failed gate or finding actually blocked or delayed promotion.\n3. Interview vendor manager for BA deliverables tied to this enhancement.\n4. Check that clinical interfaces and portals are in scope — not only corporate IT apps.\n5. For SA-12 entries, verify mapping to active SR controls in the SSP.
Audit Considerations
Assessors look for operating proof of Supplier Reviews on acquired or developed systems with ePHI — contracts, pipeline evidence, design packages, and test artifacts — not only a NIST citation for SA-12(2).
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.308(a)(1)(ii)(B) Risk Management — acquisition and development choices reduce residual risk to ePHI.\n- 164.308(a)(8) Evaluation — technical and nontechnical evaluations include systems acquired or developed for ePHI.\n- 164.314(a) Business Associate Contracts — vendors developing or hosting ePHI systems must meet security requirements.\n- 164.312(a)–(e) Technical Safeguards — acquired systems must support access, audit, integrity, auth, and transmission controls.
Compliance Tips
- List SA-12(2) in the SSP with system inventory and BA references.\n- Prioritize EHR, identity, imaging, and external connections first.\n- Bundle evidence with HIPAA evaluation (§164.308(a)(8)) and BA oversight narratives.
References & Resources
- NIST SP 800-53 Rev. 5 — SA-12(2)\n- Related controls: SA-12, SR-3\n- Rev. 5 note: SA-12 withdrawn — see Supply Chain Risk Management (SR) family
Related Guidelines
Related controls that commonly accompany SA-12(2).
Need Help Implementing SA-12(2)?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.