Assessment Objective
Determine if:
- SR-11a.
- SR-11a.[01] an anti-counterfeit policy is developed and implemented;
- SR-11a.[02] anti-counterfeit procedures are developed and implemented;
- SR-11a.[03] the anti-counterfeit procedures include the means to detect counterfeit components entering the system;
- SR-11a.[04] the anti-counterfeit procedures include the means to prevent counterfeit components from entering the system;
- SR-11b. counterfeit system components are reported to [Selection (one or more): source of counterfeit component; [Assignment: external reporting organizations] ; [Assignment: personnel or roles] ].
Assessment Methods
Examine
- Supply chain risk management policy and procedures
- supply chain risk management plan
- system and services acquisition policy
- anti-counterfeit plan
- anti-counterfeit policy and procedures
- media disposal policy
- media protection policy
- incident response policy
- reports notifying developers, manufacturers, vendors, contractors, and/or external reporting organizations of counterfeit system components
- acquisition documentation
- service level agreements
- acquisition contracts for the system, system component, or system service
- inter-organizational agreements and procedures
- records of reported counterfeit system components
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with system and service acquisition responsibilities
- organizational personnel with information security responsibilities
- organizational personnel with supply chain risk management responsibilities
- organizational personnel with responsibilities for anti-counterfeit policies, procedures, and reporting
Test
- Organizational processes for counterfeit prevention, detection, and reporting
- mechanisms supporting and/or implementing anti-counterfeit detection, prevention, and reporting
Prepojené úlohy
| Typ prepojenia | Úloha |
|---|---|
| blocks | SR-11 [H] Component Authenticity |