03.17.02E Inspection of Systems or Components

Statement

Inspect the following systems or system components {{ insert: param, A.03.17.02E.ODP.01 }} to detect tampering: {{ insert: param, A.03.17.02E.ODP.02 }}.

Guidance

Inspecting systems or systems components for evidence of tampering addresses physical and logical tampering and is applied to systems and system components that are removed from organization-controlled areas. Indications of a need for inspection include changes in packaging, specifications, factory location, or entity in which the part is purchased, and when individuals return from travel to high-risk locations. This requirement is sourced to a control tailored out of the SP 800-53B .13 moderate baseline in SP 800-171.

Statement

• (includes detect) Reduce risk due to ignorance of threat events and possible replicated or similar threat events in the same or similar environments.

  • Reduce likelihood of impact.

  • The adversary loses the advantage of stealth as defenders are better prepared by developing and sharing threat intelligence.

Assessment objective

{{ insert: param, A.03.17.02E.ODP.01 }} are inspected {{ insert: param, A.03.17.02E.ODP.02 }} to detect tampering.

Assessment method

• Supply chain risk management policy and procedures supply chain risk management plan system and services acquisition policy records of random inspections inspection reports or results assessment reports or results acquisition documentation acquisition contracts for the system, system component, or system service inter-organizational agreements and procedures system security plan service-level agreements other relevant documents or records

Assessment method

• Personnel with system and services acquisition responsibilities personnel with information security responsibilities personnel with supply chain risk management responsibilities

Assessment method

• Processes for establishing inter-organizational agreements and procedures with supply chain entities processes to inspect for tampering

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

3. Related Regulations

Linked Issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final