Assessment Objective
Determine if:
- SR-10 [Assignment: systems or system components] are inspected [Selection (one or more): at random; at [Assignment: frequency] ; upon [Assignment: indications of need for inspection] ] to detect tampering.
Assessment Methods
Examine
- Supply chain risk management policy and procedures
- supply chain risk management plan
- system and services acquisition policy
- records of random inspections
- inspection reports/results
- assessment reports/results
- acquisition documentation
- service level agreements
- acquisition contracts for the system, system component, or system service
- inter-organizational agreements and procedures
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with system and services acquisition responsibilities
- organizational personnel with information security responsibilities
- organizational personnel with supply chain risk management responsibilities
Test
- Organizational processes for establishing inter-organizational agreements and procedures with supply chain entities
- organizational processes to inspect for tampering
Gekoppelde issues
| Koppelingstype | Issue |
|---|---|
| blocks | SR-10 [M] Inspection of Systems or Components |