SR-11 Component Authenticity
Review SR-11
1. Set its parameters
No parameters to set for SR-11.
2. Record its status
a.Develop and implement anti-counterfeit policy and procedures that include the means to detect and prevent counterfeit components from entering the system; and
b.Report counterfeit system components to [Selection (one-or-more): source of counterfeit component; {{ insert: param, sr-11_odp.02 }} ; {{ insert: param, sr-11_odp.03 }} ].
Discussion
Sources of counterfeit components include manufacturers, developers, vendors, and contractors. Anti-counterfeiting policies and procedures support tamper resistance and provide a level of protection against the introduction of malicious code. External reporting organizations include CISA.
Enhancements
Review SR-11(1)
1. Set its parameters
No parameters to set for SR-11(1).
2. Record its status
Train [Assignment: organization-defined personnel or roles] to detect counterfeit system components (including hardware, software, and firmware).
Discussion
None.
Review SR-11(2)
1. Set its parameters
No parameters to set for SR-11(2).
2. Record its status
Maintain configuration control over the following system components awaiting service or repair and serviced or repaired components awaiting return to service: [Assignment: organization-defined system components].
Discussion
None.
Review SR-11(3)
1. Set its parameters
No parameters to set for SR-11(3).
2. Record its status
Scan for counterfeit system components [Assignment: organization-defined frequency].
Discussion
The type of component determines the type of scanning to be conducted (e.g., web application scanning if the component is a web application).
No Enhancements match this Baseline.
ISO/IEC 27001:2022 Crosswalk
No ISO 27001 mapping published for this control.