# Supply Chain Risk Management Policy

**Template version:** 1.0.0 · **Baseline:** High · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/policies/sr/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

> **Guidance:** The sections before and after Policy statements meet SR-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the SR-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.

## Purpose

This policy states what [Organization name] requires for Supply Chain Risk Management, and who is accountable for meeting those requirements. (SR-1a.1(a))

## Scope

This policy applies at the [Select one or more: organization-level; mission/business process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (SR-1a.1(a))

## Roles and responsibilities

- The [Chief Information Security Officer] is accountable for this policy and shall approve exceptions to it. (SR-1a.1(a))
- The [Fill in: an official to manage the development, documentation, and dissemination of the supply chain risk management policy and procedures. Typical: Chief Information Security Officer] shall manage the development, documentation and dissemination of this policy and its procedures. (SR-1b)
- Each [System owner] shall implement this policy for their system and document how in the system security plan. (SR-1a.1(a))
- Each person within scope shall follow this policy and report suspected violations to the [Chief Information Security Officer]. (SR-1a.1(a))

## Management commitment

The [Senior leader] approves this policy and shall provide the resources needed to implement it. (SR-1a.1(a))

## Coordination

The [Chief Information Security Officer] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (SR-1a.1(a))

## Compliance

- This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (SR-1a.1(b))
- The [Chief Information Security Officer] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (SR-1a.1(a))
- An exception to this policy shall be requested in writing, approved by the [Chief Information Security Officer], time-limited and recorded with its compensating measures. (SR-1a.1(a))
- Violations of this policy shall be handled through the organization's sanctions process. (SR-1a.1(a))

## Procedures

The [Fill in: an official to manage the development, documentation, and dissemination of the supply chain risk management policy and procedures. Typical: Chief Information Security Officer] shall ensure that documented procedures exist to implement this policy and its associated controls. (SR-1a.2)

## Dissemination

- The [Fill in: an official to manage the development, documentation, and dissemination of the supply chain risk management policy and procedures. Typical: Chief Information Security Officer] shall disseminate this policy to [Fill in: personnel or roles to whom supply chain risk management policy is to be disseminated to. Typical: everyone within its scope, through the policy library]. (SR-1a)
- The [Fill in: an official to manage the development, documentation, and dissemination of the supply chain risk management policy and procedures. Typical: Chief Information Security Officer] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom supply chain risk management procedures are disseminated to. Typical: the people who carry them out, and the system owners]. (SR-1a)

## Policy statements

> **Guidance:** Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

### Supply chain risk management plan (SR-2)

> **Guidance:** SR-2 asks for a plan, for each system, that covers supply chain risk across the whole life cycle. NIST's SR-2 discussion says the plan expresses the organization's supply chain risk tolerance, the acceptable mitigation strategies or controls, a process for evaluating and monitoring supply chain risk, how the plan is implemented and communicated, the justification for the mitigation measures taken, and the roles and responsibilities; it can stand alone or be part of the system security and privacy plans. [NIST SP 800-161 Rev. 1](https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final), Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (May 2022, updated November 1, 2024; current as of October 2026) recommends a stand-alone plan, and says a plan incorporated into the system security plan must keep its supply chain parts clearly discernible (Appendix A, SR-2, and Appendix D.3). Its Appendix D.3.1 is a sample plan outline, and D.3.1.11 has the plan reviewed at least at life cycle milestones, gate reviews and significant contracting activities. The plan applies the organization-wide supply chain risk management strategy (PM-30) to one system. The [Supply Chain Risk Management Plan](https://kston83.github.io/nist-guide/templates/plans/supply-chain-risk-management-plan/) template follows that outline and the more detailed outline example NIST publishes with SP 800-18 Rev. 2 (June 2026). Assessors examine the plan, its review history and who can read and change it.

- The [System owner] shall develop a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal of [Fill in: systems, system components, or system services for which a supply chain risk management plan is developed. Typical: each system, including the components and services the criticality analysis (RA-9) identifies as critical and the external services the system depends on]. (SR-2a)
- The plan shall be a stand-alone document or a clearly identifiable section of the system security plan. (SR-2a)
- The plan shall state the supply chain risk tolerance it applies from the organization's supply chain risk management strategy (PM-30), the supply chain controls selected for the system (SR-3), the process for evaluating and monitoring supply chain risk, how the plan is implemented and communicated, the justification for each mitigation measure, and the roles and responsibilities for each. (SR-2a)
- The plan shall list the system's critical components and services and their suppliers, drawing on the criticality analysis (RA-9) and the component inventory (CM-8). (SR-2a)
- The authorizing official shall approve the plan and each significant change to it. (SR-2a)
- The [System owner] shall review and update the plan [Fill in: the frequency at which to review and update the supply chain risk management plan. Typical: annually, and at each life cycle milestone or gate review and each significant contracting action, such as a new contract, a renewal or a change of supplier for a critical component or service], and whenever threat, organizational or environmental changes require it. (SR-2b)
- The [System owner] shall protect the plan from unauthorized disclosure and modification by marking it, limiting access to those who need it, and controlling changes to it. (SR-2c)

> **Guidance:** A plan that names critical components, suppliers and known weaknesses is useful to an adversary, which is why SR-2c asks for its protection. Handle it at least as carefully as the system security plan.

#### Federal systems

[OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, section 4.c(4), requires agencies to develop supply chain risk management plans as described in NIST SP 800-161 to ensure the integrity, security, resilience and quality of information systems. Under the Federal Acquisition Supply Chain Security Act of 2018, [41 U.S.C. § 1326](https://www.govinfo.gov/link/uscode/41/1326?link-type=html)(a) and (b) makes the head of each executive agency responsible for assessing the supply chain risk posed by the acquisition and use of covered articles, including developing an overall supply chain risk management strategy and implementation plan and policies and processes, and integrating supply chain risk management practices throughout the life cycle of the system, component, service or asset. The subchapter terminates on December 31, 2033 ([41 U.S.C. § 1328](https://www.govinfo.gov/link/uscode/41/1328?link-type=html)). Text checked in the United States Code, 2024 edition, as of October 2026.

- The [System owner] shall develop the system's supply chain risk management plan as NIST SP 800-161 Rev. 1 describes, as OMB Circular A-130, Appendix I, section 4.c(4), requires. (SR-2a)

### Establish SCRM team (SR-2(1))

> **Guidance:** NIST's SR-2(1) discussion describes a team-based approach drawing on diverse roles, including the risk executive, information technology, contracting, information security, privacy, mission or business, legal, supply chain and logistics, acquisition and business continuity. It can be an extension of existing security and privacy risk management processes or part of an organizational risk management team. SP 800-161 Rev. 1 calls the central body a C-SCRM program management office. In a small organization the team may be a few people who meet as needed; what matters is that acquisition, security and legal decide together.

- The [Chief Information Security Officer] shall establish a supply chain risk management team consisting of [Fill in: the personnel, roles, and responsibilities of the supply chain risk management team. Typical: a lead the Chief Information Security Officer designates, and representatives of information security, privacy, acquisition and contracting, legal counsel, information technology, the mission or business owners, and business continuity, each with the responsibilities the team charter assigns] to lead and support the following supply chain risk management activities: [Fill in: supply chain risk management activities. Typical: maintaining the supply chain risk management strategy and plans, setting the criteria for supplier assessments and reviewing their results (SR-6), reviewing acquisitions of critical components and services before award, coordinating the response to supply chain compromise notifications (SR-8), and tracking supply chain risks until they are resolved]. (SR-2(1))
- The [Chief Information Security Officer] shall document the team's membership, roles, responsibilities and decision authority in a charter. (SR-2(1))
- The team shall meet at least quarterly, and whenever an acquisition or a supplier notification needs its review, and shall record its decisions. (SR-2(1))

### Supply chain controls and processes (SR-3)

> **Guidance:** NIST's SR-3 discussion defines supply chain elements as the organizations, entities and tools involved in the research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal of systems and components. Supply chain processes include hardware, software and firmware development, shipping and handling, personnel and physical security programs, and the configuration management that maintains provenance. Weaknesses in either are potential vulnerabilities. SP 800-161 Rev. 1 points to its Section 2 and Appendix C for implementing SR-3. None of the SR-3 enhancements is in a baseline; the acquisition security requirements standard already requires suppliers to flow security requirements down to subcontractors, which is SR-3(3)'s aim.

- The [System owner] shall establish a process to identify and address weaknesses or deficiencies in the supply chain elements and processes of [Fill in: the system or system component requiring a process or processes to identify and address weaknesses or deficiencies. Typical: each system and the components and services the criticality analysis (RA-9) identifies as critical] in coordination with [Fill in: supply chain personnel with whom to coordinate the process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes. Typical: the supply chain risk management team (SR-2(1)), the procurement office, and the designated supply chain contacts of the suppliers and contractors involved]. (SR-3a)
- The process shall draw on supplier assessments, supplier notifications, inspection results, security advisories, incidents, and changes in a supplier's ownership, location or sources. (SR-3a)
- Each weakness or deficiency found shall be recorded in the risk register or the plan of action and milestones, with an owner, a response and a due date. (SR-3a)
- The [System owner] shall employ the following controls to protect against supply chain risks to the system, system component or system service and to limit the harm or consequences from supply chain-related events: [Fill in: supply chain controls employed to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events. Typical: the controls the supply chain risk management plan selects, including at least the supply chain terms of the acquisition security requirements standard (SA-4, SR-5), supplier assessments (SR-6), notification agreements (SR-8), inspection of components on receipt and after repair (SR-10), anti-counterfeit measures (SR-11) and controlled disposal (SR-12)]. (SR-3b)
- The [System owner] shall document the selected and implemented supply chain processes and controls in [Select one or more: security and privacy plans; supply chain risk management plan; [Assignment: organization-defined document]. Typical: the supply chain risk management plan, summarized and referenced in the security and privacy plans]. (SR-3c)

#### Federal systems

[OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, section 3.b(8), requires agencies' information security and privacy programs to implement supply chain risk management principles to protect against the insertion of counterfeits, unauthorized production, tampering, theft, insertion of malicious software, and poor manufacturing and development practices throughout the system development life cycle. [41 U.S.C. § 1326](https://www.govinfo.gov/link/uscode/41/1326?link-type=html)(b)(2) includes integrating supply chain risk management practices throughout the life cycle of the system, component, service or asset in each agency's responsibilities. Text checked in the United States Code, 2024 edition, as of October 2026.

- The [System owner] shall ensure the controls selected under SR-3b protect against the insertion of counterfeits, unauthorized production, tampering, theft, insertion of malicious software, and poor manufacturing and development practices throughout the system development life cycle, as OMB Circular A-130, Appendix I, section 3.b(8), requires. (SR-3b)

### Acquisition strategies, tools and methods (SR-5)

> **Guidance:** NIST's SR-5 discussion calls the acquisition process an important vehicle to protect the supply chain, and names tools such as obscuring the end use of a component, blind or filtered buys, tamper-evident packaging, and trusted or controlled distribution. It suggests incentives for suppliers that implement controls and are transparent about their practices, contract language prohibiting tainted or counterfeit components, and restricting purchases from untrustworthy suppliers, chosen in light of the supply chain risk assessment (RA-3(1)). Blind buys and controlled distribution suit high-threat environments; most organizations start with authorized sources, contract terms and supplier assessments. The contract terms themselves live in the [acquisition security requirements](https://kston83.github.io/nist-guide/templates/standards/acquisition-security-requirements/) standard (section 4.5); keep them in step with this clause. SP 800-161 Rev. 1, Section 3, covers supply chain risk management in the acquisition process.

- The [Chief Information Security Officer] shall employ the following acquisition strategies, contract tools and procurement methods to protect against, identify and mitigate supply chain risks: [Fill in: acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks. Typical: the supply chain terms of the acquisition security requirements standard, including identification of the origin of critical components and flow-down to subcontractors; contract language prohibiting counterfeit or tainted components; purchase of hardware and software only from original manufacturers, their authorized distributors or resellers, or suppliers the supply chain risk management team has assessed; a supplier risk assessment before award as part of source selection for critical components and services; and tamper-evident packaging and tracked delivery for hardware]. (SR-5)
- The [Chief Information Security Officer] shall ensure each acquisition of a component or service that the criticality analysis (RA-9) identifies as critical is reviewed by the supply chain risk management team before award. (SR-5)
- The results of the system's supply chain risk assessment (RA-3(1)) shall inform the strategies, tools and methods chosen for each such acquisition. (SR-5)

#### Federal systems

[OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), section 5.d(1)(a), requires agencies, when acquiring information technology, to analyze risks (including supply chain risks) associated with potential contractors and the products and services they provide, and to allocate risk responsibility between Government and contractor. Under [41 U.S.C. § 1323](https://www.govinfo.gov/link/uscode/41/1323?link-type=html)(c)(5) and (7), the Secretary of Homeland Security, the Secretary of Defense and the Director of National Intelligence may issue orders, on the Federal Acquisition Security Council's recommendation, excluding sources or covered articles from executive agency procurement actions or requiring the removal of covered articles from executive agency information systems, and requires executive agencies to comply with those orders; [41 CFR 201-1.304](https://www.ecfr.gov/current/title-41/section-201-1.304) repeats the duty and sets out how an agency requests an exception. [OMB M-26-05](https://www.whitehouse.gov/wp-content/uploads/2026/01/M-26-05-Adopting-a-Risk-based-Approach-to-Software-and-Hardware-Security.pdf), Adopting a Risk-based Approach to Software and Hardware Security (January 23, 2026), requires agencies to develop software and hardware assurance policies and processes that match their risk determinations and mission needs, and lets them choose to use the Secure Software Development Attestation Form and contract terms requiring a current software bill of materials on request; it names CISA's hardware bill of materials framework as a reference. Statute checked in the United States Code, 2024 edition, as of October 2026.

- The [Chief Information Security Officer] shall ensure each acquisition of information technology analyzes the supply chain risks associated with potential contractors and the products and services they provide, and allocates risk responsibility between the Government and the contractor, as OMB Circular A-130, section 5.d(1)(a), requires. (SR-5)
- The [Chief Information Security Officer] shall track the exclusion and removal orders issued under 41 U.S.C. § 1323(c)(5) that apply to the agency, ensure that procurement actions exclude the sources and covered articles they name, and ensure that system owners remove named covered articles from the agency's systems, as 41 U.S.C. § 1323(c)(7) and 41 CFR 201-1.304 require. (SR-5)
- The [Chief Information Security Officer] shall apply the agency's software and hardware assurance policy under OMB M-26-05 when choosing the strategies, tools and methods for each acquisition. (SR-5)

<!-- TODO(verify): FAR provisions that carry supply chain requirements into contracts, such as the clauses implementing exclusion orders under 41 U.S.C. § 1323 and the Section 889 telecommunications prohibition, were not checked. As for SA-4, it is not settled whether the codified FAR or the Revolutionary FAR Overhaul class deviations govern (see Open questions in PROGRESS.md). Cite the FAR here once that is resolved. -->

### Supplier assessments and reviews (SR-6)

> **Guidance:** NIST's SR-6 discussion lists what a supplier review covers: security and supply chain risk management processes; foreign ownership, control or influence; and the supplier's ability to assess its own second- and third-tier suppliers. Reviews consider documented processes and controls, all-source intelligence and publicly available information, and may be done by the organization or an independent third party. SP 800-161 Rev. 1 adds that assessments should apply a consistent set of core factors and criteria, so suppliers can be compared with each other and over time, and that the sources of information should be documented; its Appendix D.4 is a sample supply chain risk assessment template. For a cloud or other external service, the [external service review](https://kston83.github.io/nist-guide/templates/forms/external-service-review/) (SA-9) and the provider's independent attestation supply much of the evidence. The [supplier assessment questionnaire](https://kston83.github.io/nist-guide/templates/forms/supplier-assessment-questionnaire/) rates the same core risk factors for every supplier and records the source of each finding.

- The [Chief Information Security Officer] shall assess and review the supply chain-related risks associated with suppliers or contractors and the systems, system components or system services they provide [Fill in: the frequency at which to assess and review the supply chain-related risks associated with suppliers or contractors and the systems, system components, or system services they provide. Typical: before each contract award or renewal, and annually for suppliers of critical components and services]. (SR-6)
- Each assessment shall cover the supplier's security and supply chain risk management processes, its foreign ownership, control or influence, its ability to assess its own second- and third-tier suppliers, its documented processes and controls, and publicly available information about it. (SR-6)
- The [Chief Information Security Officer] shall apply the same core risk factors and criteria to every supplier assessment, and record the sources of information each one relied on. (SR-6)
- A contract for a critical component or service shall not be awarded or renewed until its supplier assessment is complete and each risk found is accepted or has a planned response. (SR-6)
- The [Chief Information Security Officer] shall have the supply chain risk management team monitor publicly available information about the suppliers of critical components and services for indications of stolen information, poor development or quality control practices, information spillage or counterfeits. (SR-6)
- The [Chief Information Security Officer] shall share assessment and review results with other organizations only as applicable rules, policies, agreements or contracts allow or require. (SR-6)

#### Federal systems

[41 U.S.C. § 1326](https://www.govinfo.gov/link/uscode/41/1326?link-type=html)(a) makes the head of each executive agency responsible for assessing the supply chain risk posed by the acquisition and use of covered articles, and for prioritizing those assessments based on the criticality of the mission, system, component, service or asset. [NIST SP 800-161 Rev. 1](https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final), Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (May 2022, updated November 1, 2024; current as of October 2026), Appendix E, gives federal agencies baseline risk factors (section E.2.2) to address, at a minimum, for assessments of critical sources and covered articles, and says (section E.2.1) that determining assessment priorities, evaluating impact and making risk response decisions are inherently governmental functions that cannot be outsourced, although a qualified, vetted third party may support research and documentation. Under [41 CFR 201-1.201(b)](https://www.ecfr.gov/current/title-41/section-201-1.201), an executive agency must expeditiously submit supply chain risk information to the Federal Acquisition Security Council's information sharing agency when the Council requests it, or when the agency determines there is a reasonable basis to conclude that a substantial supply chain risk exists in connection with a source or covered article. Statute checked in the United States Code, 2024 edition, and regulation in the eCFR, as of October 2026.

- The [Chief Information Security Officer] shall prioritize supplier assessments by the criticality of the mission, system, component, service or asset, as 41 U.S.C. § 1326(a)(2) requires. (SR-6)
- Assessments of critical sources and covered articles shall address every baseline risk factor in NIST SP 800-161 Rev. 1, Appendix E, section E.2.2. (SR-6)
- Agency officials shall set assessment priorities and make each risk response decision; a contractor may support the research and documentation but shall not make those decisions. (SR-6)
- When the agency determines there is a reasonable basis to conclude that a substantial supply chain risk exists in connection with a source or covered article, the [Chief Information Security Officer] shall submit the relevant supply chain risk information to the Federal Acquisition Security Council's information sharing agency, as 41 CFR 201-1.201(b) requires. (SR-6)

### Notification agreements (SR-8)

> **Guidance:** NIST's SR-8 discussion says early notification of compromises and potential compromises in the supply chain is essential to responding to them, and that shared assessment or audit results can help a supply chain entity resolve a concern or improve its processes. SP 800-161 Rev. 1 adds that, at a minimum, organizations should require their suppliers to establish notification agreements with the entities in their own supply chains that have a role in a critical product or service. The notice times belong in the contract: the [acquisition security requirements](https://kston83.github.io/nist-guide/templates/standards/acquisition-security-requirements/) standard (section 4.6) sets them for incidents and vulnerabilities. Notification in the other direction, from the organization to its suppliers about an incident, is the IR-6(3) clause of the Incident Response Policy.

- The [Chief Information Security Officer] shall establish agreements and procedures with the entities involved in the supply chain for the system, system component or system service for [Select one or more: notification of supply chain compromises; [Assignment: organization-defined results of assessments or audits]. Typical: notification of supply chain compromises, and the results of assessments or audits]. (SR-8)
- Each contract for a critical component or service shall require the supplier to notify the organization of a compromise or suspected compromise in its supply chain that may affect the organization's systems, within the time the acquisition security requirements standard sets for incident notice. (SR-8)
- Each such contract shall require the supplier to establish notification agreements with the entities in its own supply chain that have a role in the critical component or service. (SR-8)
- The [Chief Information Security Officer] shall keep a current notification contact for each supplier of a critical component or service, and give each supplier the organization's contact for supply chain notices. (SR-8)
- The [Incident response team] shall receive each supplier notification of a compromise and handle it under the [incident response plan](https://kston83.github.io/nist-guide/templates/plans/incident-response-plan/), with the supply chain risk management team identifying the affected systems and components. (SR-8)

### Tamper resistance and detection (SR-9)

> **Guidance:** SR-9 and SR-9(1) are in the High baseline only. NIST's SR-9 discussion says anti-tamper technologies protect against reverse engineering, modification and substitution, and that strong identification combined with tamper resistance or tamper detection is essential during distribution and in use. SP 800-161 Rev. 1 says to apply tamper resistance and detection to critical components at a minimum, using the criticality analysis (RA-9) to find them.

- The [Chief Information Security Officer] shall implement a tamper protection program for the system, system components and system services. (SR-9)
- The program shall cover, at a minimum, the components the criticality analysis (RA-9) identifies as critical. (SR-9)
- The program shall combine strong identification of components, such as serial numbers recorded in the component inventory and cryptographic device identities where components support them, with tamper resistance and tamper detection. (SR-9)
- The program shall protect components in distribution, with tamper-evident packaging and tracked or controlled delivery, and in use, with tamper-evident seals or chassis intrusion detection on critical hardware and verification of firmware and software integrity at startup or installation (SI-7). (SR-9)
- A component that shows evidence of tampering shall be kept out of service and reported as an incident under the incident response plan. (SR-9)

### Multiple stages of system development life cycle (SR-9(1))

> **Guidance:** NIST's SR-9(1) discussion lists the life cycle phases, from research and development to disposal, and says organizations use a combination of hardware and software techniques, such as obfuscation and self-checking, to make reverse engineering and modification harder; customizing systems and components can make substitution easier to detect.

- The [System owner] shall employ anti-tamper technologies, tools and techniques throughout the system development life cycle: research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal. (SR-9(1))
- Contracts for custom or critical components shall state the anti-tamper requirements the developer or manufacturer must meet in each phase it performs. (SR-9(1))
- The supply chain risk management plan shall record which anti-tamper measures apply in each phase of the life cycle. (SR-9(1))

### Inspection of systems or components (SR-10)

> **Guidance:** NIST's SR-10 discussion says inspection addresses physical and logical tampering and applies to systems and components removed from organization-controlled areas. It names the indications of a need for inspection: changes in packaging, specifications, factory location or the entity the part is bought from, and individuals returning from travel to high-risk locations. SP 800-161 Rev. 1 says to inspect critical systems and components at a minimum, before use and periodically after, and to put inspection requirements in contracts with suppliers, integrators and service providers, flowed down to subcontractors. The receipt check in the Physical and Environmental Protection Policy (PE-16) is the first inspection of every arriving component; the [component inventory](https://kston83.github.io/nist-guide/templates/forms/component-inventory/) records the result.

- The [System owner] shall inspect [Fill in: systems or system components that require inspection. Typical: the components the criticality analysis (RA-9) identifies as critical, and any component that has been outside organization-controlled areas, such as for off-site repair or travel] [Select one or more: at random; at [Assignment: organization-defined frequency]; upon [Assignment: organization-defined indications of need for inspection]. Typical: before first use and annually thereafter, and upon indications of a need for inspection] to detect tampering. (SR-10)
- Each inspection shall check for physical tampering, such as broken seals, altered packaging, missing or mismatched labels and serial numbers, and signs a case was opened, and for logical tampering, such as firmware or software that does not match the version and the hash or signature the manufacturer publishes. (SR-10)
- Each inspection shall be recorded with the component, the date, who inspected it and the result. (SR-10)
- A component that shows signs of tampering shall be kept out of service and reported under the incident response plan (IR-6). (SR-10)
- Contracts with the suppliers, integrators and service providers of critical components shall require them to inspect those components for tampering, and to flow the requirement down to their subcontractors. (SR-10)

### Component authenticity (SR-11)

> **Guidance:** NIST's SR-11 discussion names manufacturers, developers, vendors and contractors as sources of counterfeit components, says anti-counterfeit policy and procedures support tamper resistance and protect against malicious code, and names CISA as an external reporting organization. SP 800-161 Rev. 1 says the policy and procedures need input from acquisition, information technology, security, legal and the supply chain risk management team, and should address contract clauses and counterfeit reporting processes, such as the Government-Industry Data Exchange Program (GIDEP), and, where appropriate, qualified bidders or manufacturers lists. The statements below are the anti-counterfeit policy; the procedure sets out the checks for each type of component. SR-11(3), anti-counterfeit scanning, is in no baseline.

- The [Chief Information Security Officer] shall develop and implement anti-counterfeit procedures that include the means to detect and prevent counterfeit components from entering the system. (SR-11a)
- Hardware, software and firmware shall be obtained only from the original manufacturer, its authorized distributors or resellers, or a source the supply chain risk management team has assessed and approved. (SR-11a)
- Each component shall be checked on receipt against the order and the manufacturer's identifiers, such as part and serial numbers, labels and packaging. (SR-11a)
- Software, firmware and updates shall be verified by digital signature or the manufacturer's published hash before installation. (SR-11a)
- A suspected counterfeit component shall be quarantined and kept out of the system until the investigation is complete, and shall not be returned to the seller before then. (SR-11a)
- A counterfeit component found installed in a system shall be handled as an incident under the incident response plan. (SR-11a)
- The [Chief Information Security Officer] shall report counterfeit system components to [Select one or more: source of counterfeit component; [Assignment: organization-defined external reporting organizations]; [Assignment: organization-defined personnel or roles]. Typical: the source of the counterfeit component, the original manufacturer and CISA, and the Chief Information Security Officer, the supply chain risk management team and the system owner]. (SR-11b)

### Anti-counterfeit training (SR-11(1))

- The [Chief Information Security Officer] shall train [Fill in: personnel or roles requiring training to detect counterfeit system components (including hardware, software, and firmware). Typical: staff who receive, inspect, install or repair hardware, procurement staff who buy system components, and the supply chain risk management team] to detect counterfeit system components, including hardware, software and firmware. (SR-11(1))
- The training shall be part of role-based training (AT-3), completed before the person takes on the duties and annually thereafter. (SR-11(1))
- The training shall cover the organization's anti-counterfeit procedures, how to recognize counterfeit or altered hardware, packaging and software, and how to quarantine and report a suspect component. (SR-11(1))

> **Guidance:** NIST gives no discussion for SR-11(1). SP 800-161 Rev. 1 says the supply chain risk management team can help find training resources and decide who needs the training. Record completions in the training record log, as for other role-based training.

### Configuration control for component service and repair (SR-11(2))

> **Guidance:** NIST gives no discussion for SR-11(2). SP 800-161 Rev. 1 says configuration control for component service and repair should be integrated into the organization's configuration control processes, and that component authenticity should be addressed in contracts for servicing and repair. The Maintenance Policy covers approval, sanitization and the check after repair (MA-2); this clause keeps a component under control while it is away and before it returns.

- The [System owner] shall maintain configuration control over [Fill in: system components requiring configuration control. Typical: all system components, including servers, network and security devices, storage devices and end-user devices] awaiting service or repair, and over serviced or repaired components awaiting return to service. (SR-11(2))
- A component awaiting service or repair, or awaiting return to service, shall be recorded in the component inventory with the status "under maintenance", and kept in a controlled area or in the custody of an authorized person. (SR-11(2))
- A component sent off site shall be tracked by serial number from departure to return, with the maintenance log recording who had custody of it. (SR-11(2))
- Before a serviced or repaired component returns to service, it shall be checked against its inventory record, inspected for tampering (SR-10), and have its firmware and software verified and its secure baseline configuration restored (CM-2, CM-6). (SR-11(2))
- Contracts for component service and repair shall require genuine replacement parts from the original manufacturer or its authorized channel. (SR-11(2))

### Component disposal (SR-12)

> **Guidance:** NIST's SR-12 discussion says disposal can happen at any point in the life cycle, not only at retirement, and includes methods such as disk cleaning, removal of cryptographic keys and partial reuse of components. Disposal exposes paper and digital documentation, shipping and delivery records, memory sticks with code, and whole routers or servers with permanent media, and proper disposal keeps components out of the gray market. Sanitization itself follows the Media Protection Policy (MP-6); record it in the [media sanitization record](https://kston83.github.io/nist-guide/templates/forms/media-sanitization-record/), and keep the disposed component in the [component inventory](https://kston83.github.io/nist-guide/templates/forms/component-inventory/) with the status "disposed".

- The [System owner] shall dispose of [Fill in: data, documentation, tools, or system components to be disposed of. Typical: system components, media and devices that hold or have held organizational information, configurations or credentials; system, design and supply chain documentation, including shipping and delivery records; and development, test and maintenance tools] using the following techniques and methods: [Fill in: techniques and methods for disposing of data, documentation, tools, or system components. Typical: sanitization of storage by the method the media sanitization procedure sets for it (MP-6), removal of cryptographic keys, credentials and licenses, destruction of paper documentation by shredding or incineration, and transfer of hardware only to a disposal or recycling provider under contract that certifies destruction or recycling by serial number]. (SR-12)
- These techniques and methods shall apply whenever disposal happens in the life cycle, including during development, testing and maintenance. (SR-12)
- Each disposal of a component shall be recorded with the component's identifiers, the method, who performed and verified it, the date, and the media sanitization record or the provider's certificate. (SR-12)
- A component shall not be resold, donated or returned to a lessor or vendor unless its storage has been purged or destroyed as the Media Protection Policy requires and the [System owner] has approved its release. (SR-12)

## Review and update

- The [Fill in: an official to manage the development, documentation, and dissemination of the supply chain risk management policy and procedures. Typical: Chief Information Security Officer] shall review and update this policy [Fill in: the frequency at which the current supply chain risk management policy is reviewed and updated. Typical: annually] and following [Fill in: events that require the current supply chain risk management policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (SR-1c.1)
- The [Fill in: an official to manage the development, documentation, and dissemination of the supply chain risk management policy and procedures. Typical: Chief Information Security Officer] shall review and update the procedures that implement this policy [Fill in: the frequency at which the current supply chain risk management procedure is reviewed and updated. Typical: annually] and following [Fill in: events that require the supply chain risk management procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (SR-1c.2)

### Federal systems

For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

- Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (SR-1a.1(b))