Assessment Objective
Determine if:
- [Assignment: personnel or roles] are trained to detect counterfeit system components.
Assessment Methods
Examine
- Supply chain risk management policy and procedures
- supply chain risk management plan
- system and services acquisition policy
- anti-counterfeit plan
- anti-counterfeit policy and procedures
- media disposal policy
- media protection policy
- incident response policy
- training materials addressing counterfeit system components
- training records on the detection and prevention of counterfeit components entering the system
- system security plan
- other relevant documents or records
Interview
- Personnel with information security responsibilities
- personnel with supply chain risk management responsibilities
- personnel with contract management responsibilities
- personnel with personnel with responsibilities for anti-counterfeit policies, procedures, and training
Test
- Processes for anti-counterfeit training