+SR-04(04) Supply Chain Integrity — Pedigree
|
SR-04(04) Supply Chain Integrity — Pedigree
Control
Employ [Assignement: controls] and conduct [Assignement: analysis method] to ensure the integrity of the system and system components by validating the internal composition and provenance of critical or mission-essential technologies, products, and services.
Discussion
Authoritative information regarding the internal composition of system components and the provenance of technology, products, and services provides a strong basis for trust. The validation of the internal composition and provenance of technologies, products, and services is referred to as the pedigree. For microelectronics, this includes material composition of components. For software this includes the composition of open-source and proprietary code, including the version of the component at a given point in time. Pedigrees increase the assurance that the claims suppliers assert about the internal composition and provenance of the products, services, and technologies they provide are valid. The validation of the internal composition and provenance can be achieved by various evidentiary artifacts or records that manufacturers and suppliers produce during the research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal of technology, products, and services. Evidentiary artifacts include, but are not limited to, software identification (SWID) tags, software component inventory, the manufacturers’ declarations of platform attributes (e.g., serial numbers, hardware component inventory), and measurements (e.g., firmware hashes) that are tightly bound to the hardware itself.
Assessment Objective
- [Assignement: controls] are employed to ensure the integrity of the system and system components;
- [Assignement: analysis method] is conducted to ensure the integrity of the system and system components.
Assessment Method
Examine
Supply chain risk management policy and procedures
supply chain risk management plan
system and services acquisition policy
procedures addressing supply chain protection
bill of materials for critical systems or system components
acquisition documentation
software identification tags
manufacturer declarations of platform attributes (e.g., serial numbers, hardware component inventory) and measurements (e.g., firmware hashes) that are tightly bound to the hardware itself
system security plan
other relevant documents or records
Interview
Organizational personnel with system and services acquisition responsibilities
organizational personnel with information security responsibilities
organizational personnel with supply chain risk management responsibilities
1. Prezentare generală
1.1 Referințe
1.2 Cerințe identificate
1.3 Reglementări asociate
2. Cerințe identificate
3. Reglementări asociate
Reglementări
| Sursă |
Reglementare |
Tichete legate
|