SR-9 Tamper Resistance and Detection

Guidance: nonePolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
High	Organization	1 (1 in a baseline)

Related controls: PE-3, PM-30, SA-15, SI-4, SI-7, SR-3, SR-4, SR-5, SR-10, SR-11

Control statement

Implement a tamper protection program for the system, system component, or system service.

NIST discussion

Anti-tamper technologies, tools, and techniques provide a level of protection for systems, system components, and services against many threats, including reverse engineering, modification, and substitution. Strong identification combined with tamper resistance and/or tamper detection is essential to protecting systems and components during distribution and when in use.

Control enhancements

SR-9(1) Multiple Stages of System Development Life Cycle

Baselines: High

Employ anti-tamper technologies, tools, and techniques throughout the system development life cycle.

Discussion and assessment objectives for SR-9(1)

The system development life cycle includes research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal. Organizations use a combination of hardware and software techniques for tamper resistance and detection. Organizations use obfuscation and self-checking to make reverse engineering and modifications more difficult, time-consuming, and expensive for adversaries. The customization of systems and system components can make substitutions easier to detect and therefore limit damage.

Determine if anti-tamper technologies, tools, and techniques are employed throughout the system development life cycle.

Examine: Supply chain risk management policy and procedures; supply chain risk management plan; system and services acquisition policy; procedures addressing tamper resistance and detection; tamper protection program documentation; tamper protection tools and techniques documentation; tamper resistance and detection tools (technologies) and techniques documentation; system development life cycle documentation; procedures addressing supply chain protection; system development life cycle procedures; acquisition documentation; service level agreements; acquisition contracts for the system, system component, or system service; inter-organizational agreements and procedures; system security plan; other relevant documents or records.

Interview: Organizational personnel with system and services acquisition responsibilities; organizational personnel with information security responsibilities; organizational personnel with supply chain risk management responsibilities; organizational personnel with SDLC responsibilities.

Test: Organizational processes for employing anti-tamper technologies; mechanisms supporting and/or implementing anti-tamper technologies.

Assessment objectives (SP 800-53A)

Objectives and methods for SR-9

Determine if a tamper protection program is implemented for the system, system component, or system service.

Examine: Supply chain risk management policy and procedures; supply chain risk management plan; system and services acquisition policy; procedures addressing supply chain protection; procedures addressing tamper resistance and detection; tamper protection program documentation; tamper protection tools and techniques documentation; tamper resistance and detection tools and techniques documentation; acquisition documentation; service level agreements; acquisition contracts for the system, system component, or system service; system security plan; other relevant documents or records.

Interview: Organizational personnel with tamper protection program responsibilities; organizational personnel with information security responsibilities; organizational personnel with supply chain risk management responsibilities.

Test: Organizational processes for the implementation of the tamper protection program; mechanisms supporting and/or implementing the tamper protection program.

Policy statement

• The Chief Information Security Officer shall implement a tamper protection program for the system, system components and system services. (SR-9)
• The program shall cover, at a minimum, the components the criticality analysis (RA-9) identifies as critical. (SR-9)
• The program shall combine strong identification of components, such as serial numbers recorded in the component inventory and cryptographic device identities where components support them, with tamper resistance and tamper detection. (SR-9)
• The program shall protect components in distribution, with tamper-evident packaging and tracked or controlled delivery, and in use, with tamper-evident seals or chassis intrusion detection on critical hardware and verification of firmware and software integrity at startup or installation (SI-7). (SR-9)
• A component that shows evidence of tampering shall be kept out of service and reported as an incident under the incident response plan. (SR-9)

SR-9(1) Multiple stages of system development life cycle

• The System owner shall employ anti-tamper technologies, tools and techniques throughout the system development life cycle: research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal. (SR-9(1))
• Contracts for custom or critical components shall state the anti-tamper requirements the developer or manufacturer must meet in each phase it performs. (SR-9(1))
• The supply chain risk management plan shall record which anti-tamper measures apply in each phase of the life cycle. (SR-9(1))

From the Supply Chain Risk Management Policy template (draft). Highlighted fields are values your organization sets.

Artifacts

• Supply Chain Risk Management Decision Worksheet
• Supply Chain Risk Management Policy