What it asks for. SA-12 Supply Chain Protection existed in Revision 4 of SP 800-53. In Revision 5 it was withdrawn and its content moved into the new Supply Chain Risk Management (SR) family. The underlying aim remains protecting against supply chain threats to systems, components and services.
In practice. Organisations working to Revision 5 should look at controls such as SR-3 (supply chain controls and processes), SR-6 (supplier assessments and reviews) and SR-11 (component authenticity). Typical activities include a supplier risk process, security requirements in contracts, assessment of critical suppliers and checks on the origin and integrity of software and hardware. Auditors would expect to see the current SR controls mapped, rather than SA-12, in a Revision 5 assessment.
Common gaps. A common gap is carrying old Revision 4 mappings forward without updating them to the SR family. Supplier risk activity is also often limited to onboarding questionnaires with no ongoing review.