SR-10 Inspection of Systems or Components

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Low, Moderate, High	Organization	None

Related controls: AT-3, PM-30, SI-4, SI-7, SR-3, SR-4, SR-5, SR-9, SR-11

Control statement

Inspect the following systems or system components [Selection (one or more): at random; at [Assignment: organization-defined frequency] ; upon [Assignment: organization-defined indications of need for inspection] ] to detect tampering: [Assignment: organization-defined systems or system components].

NIST discussion

The inspection of systems or systems components for tamper resistance and detection addresses physical and logical tampering and is applied to systems and system components removed from organization-controlled areas. Indications of a need for inspection include changes in packaging, specifications, factory location, or entity in which the part is purchased, and when individuals return from travel to high-risk locations.

Assessment objectives (SP 800-53A)

Objectives and methods for SR-10

Determine if [Assignment: organization-defined systems or system components] are inspected [Selection (one or more): at random; at [Assignment: organization-defined frequency] ; upon [Assignment: organization-defined indications of need for inspection] ] to detect tampering.

Examine: Supply chain risk management policy and procedures; supply chain risk management plan; system and services acquisition policy; records of random inspections; inspection reports/results; assessment reports/results; acquisition documentation; service level agreements; acquisition contracts for the system, system component, or system service; inter-organizational agreements and procedures; system security plan; other relevant documents or records.

Interview: Organizational personnel with system and services acquisition responsibilities; organizational personnel with information security responsibilities; organizational personnel with supply chain risk management responsibilities.

Test: Organizational processes for establishing inter-organizational agreements and procedures with supply chain entities; organizational processes to inspect for tampering.

Policy statement

• The System owner shall inspect Fill in: systems or system components that require inspection Typical: the components the criticality analysis (RA-9) identifies as critical, and any component that has been outside organization-controlled areas, such as for off-site repair or travel Select one or more: at random; at [Assignment: organization-defined frequency]; upon [Assignment: organization-defined indications of need for inspection] Typical: before first use and annually thereafter, and upon indications of a need for inspection to detect tampering. (SR-10)
• Each inspection shall check for physical tampering, such as broken seals, altered packaging, missing or mismatched labels and serial numbers, and signs a case was opened, and for logical tampering, such as firmware or software that does not match the version and the hash or signature the manufacturer publishes. (SR-10)
• Each inspection shall be recorded with the component, the date, who inspected it and the result. (SR-10)
• A component that shows signs of tampering shall be kept out of service and reported under the incident response plan (IR-6). (SR-10)
• Contracts with the suppliers, integrators and service providers of critical components shall require them to inspect those components for tampering, and to flow the requirement down to their subcontractors. (SR-10)

From the Supply Chain Risk Management Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

SR-10 asks you to inspect the systems or components you name to detect tampering, at random, at a set frequency, when there are signs an inspection is needed, or any combination of the three. NIST’s SR-10 discussion says inspection addresses both physical and logical tampering and applies to systems and components that have been removed from organization-controlled areas. It names the indications of a need for inspection: changes in packaging, specifications, factory location or the entity the part is bought from, and people returning from travel to high-risk locations. SR-10 is in the Low, Moderate and High baselines.

NIST SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (May 2022, updated November 1, 2024; current as of October 2026), says in its Appendix A guidance for SR-10 to inspect critical systems and components at a minimum, before use and periodically after, using the criticality analysis (RA-9) to find them. It also says to put inspection requirements in contracts with suppliers, developers, system integrators and service providers, and to have prime contractors flow them down to subcontractors.

Common implementations. The first inspection is the receipt check under PE-16: each arriving component is checked against the order and for signs of tampering in the delivery area, and recorded in the component inventory with the status “received”. Before first use, firmware and software versions are compared with the versions and hashes or signatures the manufacturer publishes, as the system is built to its secure baseline. Critical hardware is inspected each year: tamper-evident seals and labels, serial numbers against the inventory, and firmware versions against the approved baseline. Components back from off-site repair and laptops back from travel to a location the organization designates as high risk are inspected, or rebuilt from a trusted image, before they reconnect. Each inspection is recorded with the component, the date, the inspector and the result.

Organization-defined parameters. Typical values, from the Supply Chain Risk Management policy, which your organization may set differently:

Parameter	Typical value
Systems or components inspected	The components the criticality analysis (RA-9) identifies as critical, and any component that has been outside organization-controlled areas, such as for off-site repair or travel
When inspections happen	Before first use and annually thereafter, and upon indications of a need for inspection
Inspection frequency	Before first use and annually thereafter
Indications of a need for inspection	Damaged or altered packaging or seals; a change in a component’s specifications, factory location or the entity it is bought from; return from off-site repair; and return of a device from travel to a location the organization designates as high risk

The second row is NIST’s selection: the policy selects a frequency and indications, and leaves out random inspection, which an organization can add. The policy also says what an inspection checks, for physical tampering and for logical tampering, keeps a component that shows signs of tampering out of service and reports it under the incident response plan (IR-6), and requires the suppliers, integrators and service providers of critical components to inspect them and flow the requirement down.

Evidence assessors ask for.

• The list of components subject to inspection, compared with the criticality analysis
• Inspection records for a sample of critical components: on receipt, before first use, and in the last year
• Inspection records for components returned from repair (the maintenance log) and devices returned from high-risk travel
• What the inspection checks: the checklist or procedure, including firmware and software verification
• Contracts for critical components with the inspection and flow-down terms
• Any tampering found, and the incident it opened

Inheritance. Receiving inspections are often a common control run by facilities or IT asset management. The system owner names the critical components and inspects what the system owns. For a cloud service, the provider inspects its own hardware; the system relies on the provider’s attestation, through the external service review, and inspects only the components it controls. Record the split in the system security plan.

Common findings.

• Receipt checks done but not recorded, so nothing shows the inspection happened.
• Components back from off-site repair put back in service with no inspection.
• Devices returned from high-risk travel reconnected without inspection or a rebuild from a trusted image.
• Firmware never compared with the manufacturer’s published versions, so logical tampering would go unnoticed.
• No list of critical components, so the annual inspection has no scope.

Enhancements in the Moderate baseline. SR-10 has no enhancements. In the High baseline, inspection also supports tamper resistance and detection (SR-9) and its enhancement SR-9(1), which the policy’s High edition covers; their guidance comes with the other High-only controls.

Artifacts

• Supply Chain Risk Management Decision Worksheet
• Supply Chain Risk Management Policy