3.17 Supply Chain Risk Management

Statement

Establish agreements and procedures with entities involved in the supply chain for the system, system component, or system service for the {{ insert: param, A.03.17.01E.ODP.01 }}.

Guidance

Establishing agreements and procedures facilitates communications among supply chain entities. Early notification of compromises and potential compromises in the supply chain that may adversely affect or have adversely affected organizational systems or system components is essential for organizations to effectively respond to such incidents. The results of assessments or audits may include open-source information that contributed to a decision or result and could be used to help the supply chain entity resolve a concern or improve its processes. This requirement is sourced to a control tailored out of the SP 800-53B .13 moderate baseline in SP 800-171.

Statement

• (includes detect) Reduce risk due to ignorance of threat events and possible replicated or similar threat events in the same or similar environments.

  • Reduce likelihood of impact.

  • The adversary loses the advantage of stealth as defenders are better prepared by developing and sharing threat intelligence.

• (includes shorten and reduce) Restrict the consequences of realized threat events by limiting the damage or effects they cause in terms of time, system resources, and/or mission or business impacts.

  • Reduce level of impact and reduce likelihood of impact of subsequent events in the same threat scenario.

  • The adversary’s effectiveness is restricted.

Assessment objective

agreements and procedures are established with entities involved in the supply chain for the system, system components, or system service for {{ insert: param, A.03.17.01E.ODP.01 }}.

Assessment method

• Supply chain risk management policy and procedures supply chain risk management plan system and services acquisition policy acquisition contracts for the system, system component, or system service procedures addressing supply chain protection acquisition documentation service-level agreements system security plan inter-organizational agreements and procedures other relevant documents or records

Assessment method

• Personnel with system and service acquisition responsibilities personnel with information security responsibilities personnel with supply chain risk management responsibilities

Assessment method

• Processes for establishing inter-organizational agreements and procedures with supply chain entities

Statement

Inspect the following systems or system components {{ insert: param, A.03.17.02E.ODP.01 }} to detect tampering: {{ insert: param, A.03.17.02E.ODP.02 }}.

Guidance

Inspecting systems or systems components for evidence of tampering addresses physical and logical tampering and is applied to systems and system components that are removed from organization-controlled areas. Indications of a need for inspection include changes in packaging, specifications, factory location, or entity in which the part is purchased, and when individuals return from travel to high-risk locations. This requirement is sourced to a control tailored out of the SP 800-53B .13 moderate baseline in SP 800-171.

Statement

• (includes detect) Reduce risk due to ignorance of threat events and possible replicated or similar threat events in the same or similar environments.

  • Reduce likelihood of impact.

  • The adversary loses the advantage of stealth as defenders are better prepared by developing and sharing threat intelligence.

Assessment objective

{{ insert: param, A.03.17.02E.ODP.01 }} are inspected {{ insert: param, A.03.17.02E.ODP.02 }} to detect tampering.

Assessment method

• Supply chain risk management policy and procedures supply chain risk management plan system and services acquisition policy records of random inspections inspection reports or results assessment reports or results acquisition documentation acquisition contracts for the system, system component, or system service inter-organizational agreements and procedures system security plan service-level agreements other relevant documents or records

Assessment method

• Personnel with system and services acquisition responsibilities personnel with information security responsibilities personnel with supply chain risk management responsibilities

Assessment method

• Processes for establishing inter-organizational agreements and procedures with supply chain entities processes to inspect for tampering

Statement

• Develop and implement anti-counterfeit policy and procedures that include the means to detect and prevent counterfeit components from entering the system.

• Report counterfeit system components to {{ insert: param, A.03.17.03E.ODP.01 }}.

Guidance

Sources of counterfeit components include manufacturers, developers, vendors, and contractors. Anti-counterfeiting policies and procedures support tamper resistance and provide a level of protection against the introduction of malicious code. External reporting organizations include the Cybersecurity and Infrastructure Security Agency (CISA). This requirement is sourced to a control tailored out of the SP 800-53B .13 moderate baseline in SP 800-171.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes detect) Reduce risk due to ignorance of threat events and possible replicated or similar threat events in the same or similar environments.

  • Reduce likelihood of impact.

  • The adversary loses the advantage of stealth as defenders are better prepared by developing and sharing threat intelligence.

Assessment objective

an anti-counterfeit policy is developed and implemented.

Assessment objective

anti-counterfeit procedures are developed and implemented.

Assessment objective

the anti-counterfeit policy and procedures include the means to detect counterfeit components entering the system.

Assessment objective

the anti-counterfeit policy and procedures include the means to prevent counterfeit components from entering the system.

Assessment objective

counterfeit system components are reported to {{ insert: param, A.03.17.03E.ODP.01 }}.

Assessment method

• Supply chain risk management policy and procedures supply chain risk management plan system and services acquisition policy anti-counterfeit plan anti-counterfeit policy and procedures media disposal policy media protection policy incident response policy reports notifying developers, manufacturers, vendors, contractors, and/or external reporting organizations of counterfeit system components acquisition documentation service-level agreements acquisition contracts for the system, system component, or system service inter-organizational agreements and procedures records of reported counterfeit system components system security plan other relevant documents or records

Assessment method

• Personnel with system and service acquisition responsibilities personnel with information security responsibilities personnel with supply chain risk management responsibilities personnel with responsibilities for anti-counterfeit policies, procedures, and reporting

Assessment method

• Processes for counterfeit prevention, detection, and reporting mechanisms supporting and/or implementing anti-counterfeit detection, prevention, and reporting

Statement

Document, monitor, and maintain valid provenance of the following systems, system components, and associated CUI: {{ insert: param, A.03.17.04E.ODP.01 }} .

Guidance

Every system and system component has a point of origin and may be changed throughout its existence. Provenance is the chronology of the origin, development, ownership, location, and changes to a system or system component and associated data. It may also include personnel and processes used to interact with or make modifications to the system, component, or associated data. Organizations have methods to document, monitor, and maintain valid provenance baselines for systems, system components, and related data. These actions help track, assess, and document any changes to the provenance, including changes in supply chain elements or configuration, and help ensure non-repudiation of provenance information and the provenance change records. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Statement

• (includes detect) Reduce risk due to ignorance of threat events and possible replicated or similar threat events in the same or similar environments.

  • Reduce likelihood of impact.

  • The adversary loses the advantage of stealth as defenders are better prepared by developing and sharing threat intelligence.

Assessment objective

valid provenance is documented for {{ insert: param, A.03.17.04E.ODP.01 }}.

Assessment objective

valid provenance is monitored for {{ insert: param, A.03.17.04E.ODP.01 }}.

Assessment objective

valid provenance is maintained for {{ insert: param, A.03.17.04E.ODP.01 }}.

Assessment method

• Supply chain risk management policy supply chain risk management procedures supply chain risk management plan documentation of critical systems, critical system components, and associated data documentation showing the history of ownership, custody, and location of and changes to critical systems or critical system components system architecture inter-organizational agreements and procedures contracts system security plan other relevant documents or records

Assessment method

• Organizational personnel with acquisition responsibilities organizational personnel with information security responsibilities organizational personnel with supply chain risk management responsibilities

Assessment method

• Organizational processes for identifying the provenance of critical systems and critical system components mechanisms used to document, monitor, or maintain provenance

Statement

Employ {{ insert: param, A.03.17.05E.ODP.01 }} and conduct {{ insert: param, A.03.17.05E.ODP.02 }} to ensure the integrity of the system and system components by validating the internal composition and provenance of critical or mission-essential technologies, products, and services.

Guidance

Authoritative information regarding the internal composition of system components and the provenance of technology, products, and services provides a strong basis for trust. The validation of the internal composition and provenance of technologies, products, and services is referred to as the pedigree. For microelectronics, this includes the material composition of components. For software this includes the composition of open-source and proprietary code, including the version of the component at a given point in time. Pedigrees increase the assurance that the claims suppliers assert about the internal composition and provenance of the products, services, and technologies they provide are valid. The validation of the internal composition and provenance can be achieved by various evidentiary artifacts or records that manufacturers and suppliers produce during the research, development, design, manufacturing, acquisition, delivery, integration, operations, maintenance, and disposal of technology, products, and services. Evidentiary artifacts include software identification (SWID) tags, software component inventory, the manufacturers’ declarations of platform attributes (e.g., serial numbers, hardware component inventory), and measurements (e.g., firmware hashes) that are tightly bound to the hardware. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Statement

• (includes detect) Reduce risk due to ignorance of threat events and possible replicated or similar threat events in the same or similar environments.

  • Reduce likelihood of impact.

  • The adversary loses the advantage of stealth as defenders are better prepared by developing and sharing threat intelligence.

Assessment objective

{{ insert: param, A.03.17.05E.ODP.01 }} are employed to ensure the integrity of the system and system components.

Assessment objective

{{ insert: param, A.03.17.05E.ODP.02 }} is conducted to ensure the integrity of the system and system components.

Assessment method

• Supply chain risk management policy and procedures supply chain risk management plan system and services acquisition policy procedures addressing supply chain protection bill of materials for critical systems or system components acquisition documentation software identification tags manufacturer declarations of platform attributes (e.g., serial numbers, hardware component inventory) and measurements (e.g., firmware hashes) that are tightly bound to the hardware itself system security plan other relevant documents or records

Assessment method

• Organizational personnel with system and services acquisition responsibilities organizational personnel with information security responsibilities organizational personnel with supply chain risk management responsibilities

Assessment method

• Organizational processes for identifying pedigree information organizational processes to determine and validate the integrity of the internal composition of critical systems and critical system components mechanisms to determine and validate the integrity of the internal composition of critical systems and critical system components