Assessment Objective

Determine if:

• SR-04[01] valid provenance is documented for [Assignment: systems, system components, and associated data];
• SR-04[02] valid provenance is monitored for [Assignment: systems, system components, and associated data];
• SR-04[03] valid provenance is maintained for [Assignment: systems, system components, and associated data].

Assessment Methods

Examine

• Supply chain risk management policy
• supply chain risk management procedures
• supply chain risk management plan
• documentation of critical systems, critical system components, and associated data
• documentation showing the history of ownership, custody, and location of and changes to critical systems or critical system components
• system architecture
• inter-organizational agreements and procedures
• contracts
• system security plan
• privacy plan
• personally identifiable information processing policy
• other relevant documents or records

Interview

• Organizational personnel with acquisition responsibilities
• organizational personnel with information security and privacy responsibilities
• organizational personnel with supply chain risk management responsibilities

Test

• Organizational processes for identifying the provenance of critical systems and critical system components
• mechanisms used to document, monitor, or maintain provenance

Linkede sager

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final