Assessment Objective
Determine if:
- SR-04(03)[01] [Assignment: controls] are employed to validate that the system or system component received is genuine;
- SR-04(03)[02] [Assignment: controls] are employed to validate that the system or system component received has not been altered.
Assessment Methods
Examine
- Supply chain risk management policy and procedures
- supply chain risk management plan
- system and services acquisition policy
- procedures addressing supply chain protection
- procedures addressing the security design principle of trusted components used in the specification, design, development, implementation, and modification of the system
- system design documentation
- procedures addressing the integration of information security requirements into the acquisition process
- solicitation documentation
- acquisition documentation
- service level agreements
- acquisition contracts for the system, system component, or system service
- evidentiary documentation (including applicable configurations) indicating that the system or system component is genuine and has not been altered
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with system and services acquisition responsibilities
- organizational personnel with information security responsibilities
- organizational personnel with supply chain risk management responsibilities
Test
- Organizational processes for defining and employing validation safeguards
- mechanisms supporting and/or implementing the definition and employment of validation safeguards
- mechanisms supporting the application of the security design principle of trusted components in system specification, design, development, implementation, and modification
Verknüpfte Vorgänge
| Verknüpfungstyp | Vorgang |
|---|---|
| blocks | SR-04(03) Validate as Genuine and Not Altered |