Assessment Objective
Determine if:
- SR-09 a tamper protection program is implemented for the system, system component, or system service.
Assessment Methods
Examine
- Supply chain risk management policy and procedures
- supply chain risk management plan
- system and services acquisition policy
- procedures addressing supply chain protection
- procedures addressing tamper resistance and detection
- tamper protection program documentation
- tamper protection tools and techniques documentation
- tamper resistance and detection tools and techniques documentation
- acquisition documentation
- service level agreements
- acquisition contracts for the system, system component, or system service
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with tamper protection program responsibilities
- organizational personnel with information security responsibilities
- organizational personnel with supply chain risk management responsibilities
Test
- Organizational processes for the implementation of the tamper protection program
- mechanisms supporting and/or implementing the tamper protection program
Linked Issues
| Linktype | Issue |
|---|---|
| blocks | SR-09 Tamper Resistance and Detection |