SR-11 Component Authenticity

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Low, Moderate, High	Organization	3 (2 in a baseline)

Related controls: PE-3, SA-4, SI-7, SR-9, SR-10

Control statement

• a. Develop and implement anti-counterfeit policy and procedures that include the means to detect and prevent counterfeit components from entering the system; and
• b. Report counterfeit system components to [Selection (one or more): source of counterfeit component; [Assignment: organization-defined external reporting organizations] ; [Assignment: organization-defined personnel or roles] ].

NIST discussion

Sources of counterfeit components include manufacturers, developers, vendors, and contractors. Anti-counterfeiting policies and procedures support tamper resistance and provide a level of protection against the introduction of malicious code. External reporting organizations include CISA.

Control enhancements

SR-11(1) Anti-counterfeit Training

Baselines: Low, Moderate, High

Train [Assignment: organization-defined personnel or roles] to detect counterfeit system components (including hardware, software, and firmware).

Discussion and assessment objectives for SR-11(1)

None.

Determine if [Assignment: organization-defined personnel or roles] are trained to detect counterfeit system components (including hardware, software, and firmware).

Examine: Supply chain risk management policy and procedures; supply chain risk management plan; system and services acquisition policy; anti-counterfeit plan; anti-counterfeit policy and procedures; media disposal policy; media protection policy; incident response policy; training materials addressing counterfeit system components; training records on the detection and prevention of counterfeit components entering the system; system security plan; other relevant documents or records.

Interview: Organizational personnel with information security responsibilities; organizational personnel with supply chain risk management responsibilities; organizational personnel with responsibilities for anti-counterfeit policies, procedures, and training.

Test: Organizational processes for anti-counterfeit training.

SR-11(2) Configuration Control for Component Service and Repair

Baselines: Low, Moderate, High

Maintain configuration control over the following system components awaiting service or repair and serviced or repaired components awaiting return to service: [Assignment: organization-defined system components].

Discussion and assessment objectives for SR-11(2)

None.

Determine if:

• SR-11(02)[01] configuration control over [Assignment: organization-defined system components] awaiting service or repair is maintained;
• SR-11(02)[02] configuration control over serviced or repaired [Assignment: organization-defined system components] awaiting return to service is maintained.

Examine: Supply chain risk management policy and procedures; supply chain risk management plan; configuration control procedures; acquisition documentation; service level agreements; acquisition contracts for the system component; inter-organizational agreements and procedures; system security plan; other relevant documents or records.

Interview: Organizational personnel with system and services acquisition responsibilities; organizational personnel with information security responsibilities; organizational personnel with supply chain risk management responsibilities.

Test: Organizational processes for establishing inter-organizational agreements and procedures with supply chain entities; organizational configuration control processes.

SR-11(3) Anti-counterfeit Scanning

Baselines: Not in a baseline

Scan for counterfeit system components [Assignment: organization-defined frequency].

Discussion and assessment objectives for SR-11(3)

The type of component determines the type of scanning to be conducted (e.g., web application scanning if the component is a web application).

Determine if scanning for counterfeit system components is conducted [Assignment: organization-defined frequency].

Examine: Supply chain risk management policy and procedures; supply chain risk management plan; anti-counterfeit policy and procedures; system design documentation; system configuration settings and associated documentation; scanning tools and associated documentation; scanning results; procedures addressing supply chain protection; acquisition documentation; inter-organizational agreements and procedures; system security plan; other relevant documents or records.

Interview: Organizational personnel with system and services acquisition responsibilities; organizational personnel with information security responsibilities; organizational personnel with supply chain risk management responsibilities; organizational personnel with responsibilities for anti-counterfeit policies and procedures; organizational personnel with responsibility for anti-counterfeit scanning.

Test: Organizational processes for scanning for counterfeit system components; mechanisms supporting and/or implementing anti-counterfeit scanning.

Assessment objectives (SP 800-53A)

Objectives and methods for SR-11

Determine if:

• SR-11a.
  • SR-11a.[01] an anti-counterfeit policy is developed and implemented;
  • SR-11a.[02] anti-counterfeit procedures are developed and implemented;
  • SR-11a.[03] the anti-counterfeit procedures include the means to detect counterfeit components entering the system;
  • SR-11a.[04] the anti-counterfeit procedures include the means to prevent counterfeit components from entering the system;
• SR-11b. counterfeit system components are reported to [Selection (one or more): source of counterfeit component; [Assignment: organization-defined external reporting organizations] ; [Assignment: organization-defined personnel or roles] ].

Examine: Supply chain risk management policy and procedures; supply chain risk management plan; system and services acquisition policy; anti-counterfeit plan; anti-counterfeit policy and procedures; media disposal policy; media protection policy; incident response policy; reports notifying developers, manufacturers, vendors, contractors, and/or external reporting organizations of counterfeit system components; acquisition documentation; service level agreements; acquisition contracts for the system, system component, or system service; inter-organizational agreements and procedures; records of reported counterfeit system components; system security plan; other relevant documents or records.

Interview: Organizational personnel with system and service acquisition responsibilities; organizational personnel with information security responsibilities; organizational personnel with supply chain risk management responsibilities; organizational personnel with responsibilities for anti-counterfeit policies, procedures, and reporting.

Test: Organizational processes for counterfeit prevention, detection, and reporting; mechanisms supporting and/or implementing anti-counterfeit detection, prevention, and reporting.

Policy statement

• The Chief Information Security Officer shall develop and implement anti-counterfeit procedures that include the means to detect and prevent counterfeit components from entering the system. (SR-11a)
• Hardware, software and firmware shall be obtained only from the original manufacturer, its authorized distributors or resellers, or a source the supply chain risk management team has assessed and approved. (SR-11a)
• Each component shall be checked on receipt against the order and the manufacturer’s identifiers, such as part and serial numbers, labels and packaging. (SR-11a)
• Software, firmware and updates shall be verified by digital signature or the manufacturer’s published hash before installation. (SR-11a)
• A suspected counterfeit component shall be quarantined and kept out of the system until the investigation is complete, and shall not be returned to the seller before then. (SR-11a)
• A counterfeit component found installed in a system shall be handled as an incident under the incident response plan. (SR-11a)
• The Chief Information Security Officer shall report counterfeit system components to Select one or more: source of counterfeit component; [Assignment: organization-defined external reporting organizations]; [Assignment: organization-defined personnel or roles] Typical: the source of the counterfeit component, the original manufacturer and CISA, and the Chief Information Security Officer, the supply chain risk management team and the system owner. (SR-11b)

SR-11(1) Anti-counterfeit training

• The Chief Information Security Officer shall train Fill in: personnel or roles requiring training to detect counterfeit system components (including hardware, software, and firmware) Typical: staff who receive, inspect, install or repair hardware, procurement staff who buy system components, and the supply chain risk management team to detect counterfeit system components, including hardware, software and firmware. (SR-11(1))
• The training shall be part of role-based training (AT-3), completed before the person takes on the duties and annually thereafter. (SR-11(1))
• The training shall cover the organization’s anti-counterfeit procedures, how to recognize counterfeit or altered hardware, packaging and software, and how to quarantine and report a suspect component. (SR-11(1))

SR-11(2) Configuration control for component service and repair

• The System owner shall maintain configuration control over Fill in: system components requiring configuration control Typical: all system components, including servers, network and security devices, storage devices and end-user devices awaiting service or repair, and over serviced or repaired components awaiting return to service. (SR-11(2))
• A component awaiting service or repair, or awaiting return to service, shall be recorded in the component inventory with the status “under maintenance”, and kept in a controlled area or in the custody of an authorized person. (SR-11(2))
• A component sent off site shall be tracked by serial number from departure to return, with the maintenance log recording who had custody of it. (SR-11(2))
• Before a serviced or repaired component returns to service, it shall be checked against its inventory record, inspected for tampering (SR-10), and have its firmware and software verified and its secure baseline configuration restored (CM-2, CM-6). (SR-11(2))
• Contracts for component service and repair shall require genuine replacement parts from the original manufacturer or its authorized channel. (SR-11(2))

From the Supply Chain Risk Management Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

SR-11 asks for an anti-counterfeit policy and procedures that include the means to detect counterfeit components and keep them out of the system (a), and for reporting counterfeit components to the source of the component, to external reporting organizations, to people inside the organization, or any combination (b). NIST’s SR-11 discussion names manufacturers, developers, vendors and contractors as sources of counterfeit components, says anti-counterfeit policies and procedures support tamper resistance and protect against the introduction of malicious code, and names CISA as an external reporting organization. SR-11 is in the Low, Moderate and High baselines.

NIST SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (May 2022, updated November 1, 2024; current as of October 2026), adds in its Appendix A guidance for SR-11 that the policy and procedures need input from acquisition, information technology, IT security, legal and the supply chain risk management office. They should address regulatory requirements, contract clauses, and counterfeit reporting processes, such as the Government-Industry Data Exchange Program (GIDEP), and, where appropriate, qualified bidders or qualified manufacturers lists, which keep purchases with authorized suppliers.

The anti-counterfeit policy is the SR-11 statements of the Supply Chain Risk Management policy; the procedure sets out the checks for each type of component. Buying from authorized sources is the strongest control, which is why the same rule appears in SR-5.

Common implementations. Hardware bought only from the original manufacturer, its authorized distributors or resellers, or a source the supply chain risk management team has approved. A receipt check of part and serial numbers, labels and packaging against the order and the manufacturer’s identifiers, under PE-16, recorded in the component inventory. Software, firmware and updates downloaded from the manufacturer’s own site or repository and verified by digital signature or published hash before installation, usually automatically by the package manager, the endpoint management tool or the build pipeline. A marked quarantine shelf or cage for suspect components. A counterfeit found in a running system is handled as an incident under the incident response plan.

Organization-defined parameters. Typical values, from the Supply Chain Risk Management policy, which your organization may set differently:

Parameter	Typical value
Who counterfeit components are reported to (b)	The source of the counterfeit component, the original manufacturer and CISA, and the Chief Information Security Officer, the supply chain risk management team and the system owner
External reporting organizations (b)	The original manufacturer of the genuine component, and CISA
Personnel or roles reported to (b)	The Chief Information Security Officer, the supply chain risk management team and the system owner
Staff trained to detect counterfeits (SR-11(1))	Staff who receive, inspect, install or repair hardware, procurement staff who buy system components, and the supply chain risk management team
Components kept under configuration control during service and repair (SR-11(2))	All system components, including servers, network and security devices, storage devices and end-user devices

The first row is NIST’s selection: the policy selects all three choices, and the next two rows fill in the nested values. The policy also keeps a suspected counterfeit out of the system until the investigation is complete and does not return it to the seller before then, so evidence is not lost and the part does not go back into circulation.

Evidence assessors ask for.

• The anti-counterfeit procedures, and the list of authorized sources
• Purchase records for a sample of installed hardware, showing an authorized source
• Receipt check records, and the settings or logs showing signature or hash verification of software and firmware
• Quarantine records and reports made for any suspected counterfeit, including to CISA or the manufacturer
• For SR-11(1), training records for receiving, IT and procurement staff (the training record log)
• For SR-11(2), the maintenance log and inventory records showing custody of components away for repair, and the check before each returned to service

Inheritance. Purchasing rules, receiving checks and training are usually common controls. The system owner makes sure the system’s components come through those channels, that software verification is turned on in the system’s tools, and that suspect components in the system are reported. Record the split in the system security plan.

Common findings.

• Replacement parts or memory bought from online marketplaces or brokers to save money or time, outside the authorized channel.
• Software or drivers downloaded from mirror sites with no signature or hash check.
• No reporting path: a suspect part is returned to the seller for a refund and the matter ends there.
• Receiving staff never trained to recognize counterfeit hardware or packaging.
• A component back from repair put into service without a check against its inventory record.

Enhancements in the Moderate baseline. Both are also in Low and High, with values in the table above.

• SR-11(1) anti-counterfeit training. NIST gives no discussion; SP 800-161 Rev. 1 says the supply chain risk management office can help find training resources and decide who needs the training. The policy makes it part of role-based training (AT-3), before the person takes on the duties and annually thereafter; plan it in the security and privacy training plan.
• SR-11(2) configuration control for component service and repair. NIST gives no discussion; SP 800-161 Rev. 1 says configuration control for service and repair should be integrated into the organization’s configuration control processes, and component authenticity addressed in contracts for servicing and repair. The policy records the component as “under maintenance” in the inventory, tracks it by serial number with custody in the maintenance log, inspects it for tampering (SR-10) and restores its secure baseline (CM-2, CM-6) before it returns, and requires genuine replacement parts in repair contracts. The Maintenance Policy (MA-2) covers approval, sanitization and the check after repair.

SR-11(3), anti-counterfeit scanning, is in no baseline. High systems add tamper resistance and detection (SR-9).

Artifacts

• Supply Chain Risk Management Decision Worksheet
• Supply Chain Risk Management Policy