Assessment Objective
Determine if:
- [Assignment: systems or system components] are inspected [Assignment: SELECTED PARAMETER VALUE(S)] to detect tampering.
Assessment Methods
Examine
- Supply chain risk management policy and procedures
- supply chain risk management plan
- system and services acquisition policy
- records of random inspections
- inspection reports or results
- assessment reports or results
- acquisition documentation
- acquisition contracts for the system, system component, or system service
- inter-organizational agreements and procedures
- system security plan
- service-level agreements
- other relevant documents or records
Interview
- Personnel with system and services acquisition responsibilities
- personnel with information security responsibilities
- personnel with supply chain risk management responsibilities
Test
- Processes for establishing inter-organizational agreements and procedures with supply chain entities
- processes to inspect for tampering