+SR-04(03) Validate as Genuine and Not Altered

SR-04(03) Validate as Genuine and Not Altered

Control

Employ the following controls to validate that the system or system component received is genuine and has not been altered: [Assignement: organization-defined controls].

Discussion

For many systems and system components, especially hardware, there are technical means to determine if the items are genuine or have been altered, including optical and nanotechnology tagging, physically unclonable functions, side-channel analysis, cryptographic hash verifications or digital signatures, and visible anti-tamper labels or stickers. Controls can also include monitoring for out of specification performance, which can be an indicator of tampering or counterfeits. Organizations may leverage supplier and contractor processes for validating that a system or component is genuine and has not been altered and for replacing a suspect system or component. Some indications of tampering may be visible and addressable before accepting delivery, such as inconsistent packaging, broken seals, and incorrect labels. When a system or system component is suspected of being altered or counterfeit, the supplier, contractor, or original equipment manufacturer may be able to replace the item or provide a forensic capability to determine the origin of the counterfeit or altered item. Organizations can provide training to personnel on how to identify suspicious system or component deliveries.

Assessment Objective

  1. [Assignement: controls] are employed to validate that the system or system component received is genuine;
  2. [Assignement: controls] are employed to validate that the system or system component received has not been altered.

Assessment Method

Examine

Supply chain risk management policy and procedures supply chain risk management plan system and services acquisition policy procedures addressing supply chain protection procedures addressing the security design principle of trusted components used in the specification, design, development, implementation, and modification of the system system design documentation procedures addressing the integration of information security requirements into the acquisition process solicitation documentation acquisition documentation service level agreements acquisition contracts for the system, system component, or system service evidentiary documentation (including applicable configurations) indicating that the system or system component is genuine and has not been altered system security plan other relevant documents or records

Interview

Organizational personnel with system and services acquisition responsibilities organizational personnel with information security responsibilities organizational personnel with supply chain risk management responsibilities

1. Visão geral

1.1 Referências

1.2 Requisitos identificados

1.3 Regulamentos relacionados

2. Requisitos identificados

Requisitos

3. Regulamentos relacionados

Regulamentos

Pedidos ligados

Ligações
is blocked by SR-04(03) Validate as Genuine and Not Altered – Assessment Procedure
is blocked by Product Tampering and Counterfeiting (PTC)