Assessment Objective

Determine if:

• SR-04(03)[01] [Assignment: controls] are employed to validate that the system or system component received is genuine;
• SR-04(03)[02] [Assignment: controls] are employed to validate that the system or system component received has not been altered.

Assessment Methods

Examine

• Supply chain risk management policy and procedures
• supply chain risk management plan
• system and services acquisition policy
• procedures addressing supply chain protection
• procedures addressing the security design principle of trusted components used in the specification, design, development, implementation, and modification of the system
• system design documentation
• procedures addressing the integration of information security requirements into the acquisition process
• solicitation documentation
• acquisition documentation
• service level agreements
• acquisition contracts for the system, system component, or system service
• evidentiary documentation (including applicable configurations) indicating that the system or system component is genuine and has not been altered
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with system and services acquisition responsibilities
• organizational personnel with information security responsibilities
• organizational personnel with supply chain risk management responsibilities

Test

• Organizational processes for defining and employing validation safeguards
• mechanisms supporting and/or implementing the definition and employment of validation safeguards
• mechanisms supporting the application of the security design principle of trusted components in system specification, design, development, implementation, and modification

Συνδεδεμένα ζητήματα

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final