Supply Chain Risk Management Policy

Supply Chain Risk Management Policy template: Ready-to-adopt Supply Chain Risk Management policy template for NIST SP 800-53 Rev. 5, with a statement group for each control and a variant per baseline (Low, Moderate, High).

Type	Program stage	Status	Template version	NIST basis
Policy	Mature	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

The Supply Chain Risk Management policy states what the organization requires for supply chain risk management and who is accountable for it. It meets SR-1 through the sections every family policy shares, and adds one statement group per control. Each baseline variant includes only the controls in that baseline, taken from the NIST SP 800-53B profiles.

Adopt the ready-to-adopt edition: fill every highlighted field, delete any “Federal systems” section that does not apply, and have the accountable official approve it. The annotated edition adds guidance on why each section exists and what assessors look for.

Controls satisfied

“Yes” marks the baseline variants that include the control’s statements. SR-1 is met by the common sections.

Control	Title	Low	Moderate	High	Privacy
SR-1	Policy and Procedures	Yes	Yes	Yes
SR-2	Supply Chain Risk Management Plan	Yes	Yes	Yes
SR-2(1)	Establish SCRM Team	Yes	Yes	Yes
SR-3	Supply Chain Controls and Processes	Yes	Yes	Yes
SR-5	Acquisition Strategies, Tools, and Methods	Yes	Yes	Yes
SR-6	Supplier Assessments and Reviews		Yes	Yes
SR-8	Notification Agreements	Yes	Yes	Yes
SR-9	Tamper Resistance and Detection			Yes
SR-9(1)	Multiple Stages of System Development Life Cycle			Yes
SR-10	Inspection of Systems or Components	Yes	Yes	Yes
SR-11	Component Authenticity	Yes	Yes	Yes
SR-11(1)	Anti-counterfeit Training	Yes	Yes	Yes
SR-11(2)	Configuration Control for Component Service and Repair	Yes	Yes	Yes
SR-12	Component Disposal	Yes	Yes	Yes

Decisions to make first

The policy has 32 organization-defined parameters across all variants; each appears as a highlighted field with its typical value where one is given. Settle these first:

Decision	Controls	Typical	Who decides
Who leads supply chain risk management, and who sits on the team?	SR-2(1), SR-3	A lead the Chief Information Security Officer designates chairs a standing team with members from information security, privacy, acquisition and contracting, legal counsel, information technology, the mission or business owners and business continuity, under a written charter; the team meets each quarter and whenever an acquisition or supplier notification needs its review.	Chief Information Security Officer
Which systems, components and services get the most supply chain scrutiny?	SR-2, SR-3, SR-6, SR-9, SR-10	Every system has a supply chain risk management plan; the components and services the criticality analysis (RA-9) identifies as critical, and their suppliers, get the supplier assessments, notification terms, inspections and (for High systems) tamper protection the plan selects.	System owner, with the supply chain risk management team
Where may the organization buy system components, and how are suppliers vetted?	SR-5, SR-6, SR-11	Hardware and software come only from original manufacturers, their authorized distributors or resellers, or suppliers the supply chain risk management team has assessed; each supplier of a critical component or service is assessed before award or renewal and each year, with the same core risk factors applied to every supplier.	Chief Information Security Officer, with the procurement office
What must suppliers tell the organization, and how quickly?	SR-8	Contracts for critical components and services require notice of a supply chain compromise within the incident notice time of the acquisition security requirements standard, sharing of the results of independent assessments or audits, and the same notification terms in the supplier’s agreements with its own suppliers.	Chief Information Security Officer, with the procurement office
How are counterfeit or tampered components found and handled?	SR-10, SR-11, SR-11(1), SR-11(2)	Components are checked on receipt and before first use, critical components are inspected each year and after repair or travel, software is verified by signature or published hash, and a suspect component is quarantined, handled as an incident and reported to its source, its original manufacturer and CISA; staff who handle or buy hardware are trained to spot counterfeits.	Chief Information Security Officer
How are components, documentation and tools disposed of so they cannot re-enter the supply chain?	SR-12	Storage is sanitized under the media sanitization procedure, keys, credentials and licenses are removed, paper is shredded, and hardware goes only to a contracted disposal or recycling provider that certifies destruction or recycling by serial number, with each disposal recorded.	System owner

Record your values in the Supply Chain Risk Management decision worksheet, which lists every parameter with its typical value.

Downloads

Variant	Ready to adopt	Annotated
Low	Word · Markdown	Word · Markdown
Moderate	Word · Markdown	Word · Markdown
High	Word · Markdown	Word · Markdown

Everything for this family in one file: SR pack (.zip), with every variant and edition of the policy and the decision worksheets.

Preview (Moderate baseline, annotated)

Guidance

The sections before and after Policy statements meet SR-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the SR-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.

Purpose

This policy states what Organization name requires for Supply Chain Risk Management, and who is accountable for meeting those requirements. (SR-1a.1(a))

Scope

This policy applies at the Select one or more: organization-level; mission/business process-level; system-level Typical: organization-level to every system that Organization name owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (SR-1a.1(a))

Roles and responsibilities

• The Chief Information Security Officer is accountable for this policy and shall approve exceptions to it. (SR-1a.1(a))
• The Fill in: an official to manage the development, documentation, and dissemination of the supply chain risk management policy and procedures Typical: Chief Information Security Officer shall manage the development, documentation and dissemination of this policy and its procedures. (SR-1b)
• Each System owner shall implement this policy for their system and document how in the system security plan. (SR-1a.1(a))
• Each person within scope shall follow this policy and report suspected violations to the Chief Information Security Officer. (SR-1a.1(a))

Management commitment

The Senior leader approves this policy and shall provide the resources needed to implement it. (SR-1a.1(a))

Coordination

The Chief Information Security Officer shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (SR-1a.1(a))

Compliance

• This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to Organization name, including Fill in: laws, regulations and standards that apply to the organization. (SR-1a.1(b))
• The Chief Information Security Officer shall review compliance with this policy through the organization’s assessment and continuous monitoring activities. (SR-1a.1(a))
• An exception to this policy shall be requested in writing, approved by the Chief Information Security Officer, time-limited and recorded with its compensating measures. (SR-1a.1(a))
• Violations of this policy shall be handled through the organization’s sanctions process. (SR-1a.1(a))

Procedures

The Fill in: an official to manage the development, documentation, and dissemination of the supply chain risk management policy and procedures Typical: Chief Information Security Officer shall ensure that documented procedures exist to implement this policy and its associated controls. (SR-1a.2)

Dissemination

• The Fill in: an official to manage the development, documentation, and dissemination of the supply chain risk management policy and procedures Typical: Chief Information Security Officer shall disseminate this policy to Fill in: personnel or roles to whom supply chain risk management policy is to be disseminated to Typical: everyone within its scope, through the policy library. (SR-1a)
• The Fill in: an official to manage the development, documentation, and dissemination of the supply chain risk management policy and procedures Typical: Chief Information Security Officer shall disseminate the procedures that implement this policy to Fill in: personnel or roles to whom supply chain risk management procedures are disseminated to Typical: the people who carry them out, and the system owners. (SR-1a)

Policy statements

Guidance

Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

Supply chain risk management plan (SR-2)

Guidance

SR-2 asks for a plan, for each system, that covers supply chain risk across the whole life cycle. NIST’s SR-2 discussion says the plan expresses the organization’s supply chain risk tolerance, the acceptable mitigation strategies or controls, a process for evaluating and monitoring supply chain risk, how the plan is implemented and communicated, the justification for the mitigation measures taken, and the roles and responsibilities; it can stand alone or be part of the system security and privacy plans. NIST SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (May 2022, updated November 1, 2024; current as of October 2026) recommends a stand-alone plan, and says a plan incorporated into the system security plan must keep its supply chain parts clearly discernible (Appendix A, SR-2, and Appendix D.3). Its Appendix D.3.1 is a sample plan outline, and D.3.1.11 has the plan reviewed at least at life cycle milestones, gate reviews and significant contracting activities. The plan applies the organization-wide supply chain risk management strategy (PM-30) to one system. The Supply Chain Risk Management Plan template follows that outline and the more detailed outline example NIST publishes with SP 800-18 Rev. 2 (June 2026). Assessors examine the plan, its review history and who can read and change it.

• The System owner shall develop a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal of Fill in: systems, system components, or system services for which a supply chain risk management plan is developed Typical: each system, including the components and services the criticality analysis (RA-9) identifies as critical and the external services the system depends on. (SR-2a)
• The plan shall be a stand-alone document or a clearly identifiable section of the system security plan. (SR-2a)
• The plan shall state the supply chain risk tolerance it applies from the organization’s supply chain risk management strategy (PM-30), the supply chain controls selected for the system (SR-3), the process for evaluating and monitoring supply chain risk, how the plan is implemented and communicated, the justification for each mitigation measure, and the roles and responsibilities for each. (SR-2a)
• The plan shall list the system’s critical components and services and their suppliers, drawing on the criticality analysis (RA-9) and the component inventory (CM-8). (SR-2a)
• The authorizing official shall approve the plan and each significant change to it. (SR-2a)
• The System owner shall review and update the plan Fill in: the frequency at which to review and update the supply chain risk management plan Typical: annually, and at each life cycle milestone or gate review and each significant contracting action, such as a new contract, a renewal or a change of supplier for a critical component or service, and whenever threat, organizational or environmental changes require it. (SR-2b)
• The System owner shall protect the plan from unauthorized disclosure and modification by marking it, limiting access to those who need it, and controlling changes to it. (SR-2c)

Guidance

A plan that names critical components, suppliers and known weaknesses is useful to an adversary, which is why SR-2c asks for its protection. Handle it at least as carefully as the system security plan.

Federal systems

OMB Circular A-130, Appendix I, section 4.c(4), requires agencies to develop supply chain risk management plans as described in NIST SP 800-161 to ensure the integrity, security, resilience and quality of information systems. Under the Federal Acquisition Supply Chain Security Act of 2018, 41 U.S.C. § 1326(a) and (b) makes the head of each executive agency responsible for assessing the supply chain risk posed by the acquisition and use of covered articles, including developing an overall supply chain risk management strategy and implementation plan and policies and processes, and integrating supply chain risk management practices throughout the life cycle of the system, component, service or asset. The subchapter terminates on December 31, 2033 (41 U.S.C. § 1328). Text checked in the United States Code, 2024 edition, as of October 2026.

• The System owner shall develop the system’s supply chain risk management plan as NIST SP 800-161 Rev. 1 describes, as OMB Circular A-130, Appendix I, section 4.c(4), requires. (SR-2a)

Establish SCRM team (SR-2(1))

Guidance

NIST’s SR-2(1) discussion describes a team-based approach drawing on diverse roles, including the risk executive, information technology, contracting, information security, privacy, mission or business, legal, supply chain and logistics, acquisition and business continuity. It can be an extension of existing security and privacy risk management processes or part of an organizational risk management team. SP 800-161 Rev. 1 calls the central body a C-SCRM program management office. In a small organization the team may be a few people who meet as needed; what matters is that acquisition, security and legal decide together.

• The Chief Information Security Officer shall establish a supply chain risk management team consisting of Fill in: the personnel, roles, and responsibilities of the supply chain risk management team Typical: a lead the Chief Information Security Officer designates, and representatives of information security, privacy, acquisition and contracting, legal counsel, information technology, the mission or business owners, and business continuity, each with the responsibilities the team charter assigns to lead and support the following supply chain risk management activities: Fill in: supply chain risk management activities Typical: maintaining the supply chain risk management strategy and plans, setting the criteria for supplier assessments and reviewing their results (SR-6), reviewing acquisitions of critical components and services before award, coordinating the response to supply chain compromise notifications (SR-8), and tracking supply chain risks until they are resolved. (SR-2(1))
• The Chief Information Security Officer shall document the team’s membership, roles, responsibilities and decision authority in a charter. (SR-2(1))
• The team shall meet at least quarterly, and whenever an acquisition or a supplier notification needs its review, and shall record its decisions. (SR-2(1))

Supply chain controls and processes (SR-3)

Guidance

NIST’s SR-3 discussion defines supply chain elements as the organizations, entities and tools involved in the research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal of systems and components. Supply chain processes include hardware, software and firmware development, shipping and handling, personnel and physical security programs, and the configuration management that maintains provenance. Weaknesses in either are potential vulnerabilities. SP 800-161 Rev. 1 points to its Section 2 and Appendix C for implementing SR-3. None of the SR-3 enhancements is in a baseline; the acquisition security requirements standard already requires suppliers to flow security requirements down to subcontractors, which is SR-3(3)‘s aim.

• The System owner shall establish a process to identify and address weaknesses or deficiencies in the supply chain elements and processes of Fill in: the system or system component requiring a process or processes to identify and address weaknesses or deficiencies Typical: each system and the components and services the criticality analysis (RA-9) identifies as critical in coordination with Fill in: supply chain personnel with whom to coordinate the process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes Typical: the supply chain risk management team (SR-2(1)), the procurement office, and the designated supply chain contacts of the suppliers and contractors involved. (SR-3a)
• The process shall draw on supplier assessments, supplier notifications, inspection results, security advisories, incidents, and changes in a supplier’s ownership, location or sources. (SR-3a)
• Each weakness or deficiency found shall be recorded in the risk register or the plan of action and milestones, with an owner, a response and a due date. (SR-3a)
• The System owner shall employ the following controls to protect against supply chain risks to the system, system component or system service and to limit the harm or consequences from supply chain-related events: Fill in: supply chain controls employed to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events Typical: the controls the supply chain risk management plan selects, including at least the supply chain terms of the acquisition security requirements standard (SA-4, SR-5), supplier assessments (SR-6), notification agreements (SR-8), inspection of components on receipt and after repair (SR-10), anti-counterfeit measures (SR-11) and controlled disposal (SR-12). (SR-3b)
• The System owner shall document the selected and implemented supply chain processes and controls in Select one or more: security and privacy plans; supply chain risk management plan; [Assignment: organization-defined document] Typical: the supply chain risk management plan, summarized and referenced in the security and privacy plans. (SR-3c)

Federal systems

OMB Circular A-130, Appendix I, section 3.b(8), requires agencies’ information security and privacy programs to implement supply chain risk management principles to protect against the insertion of counterfeits, unauthorized production, tampering, theft, insertion of malicious software, and poor manufacturing and development practices throughout the system development life cycle. 41 U.S.C. § 1326(b)(2) includes integrating supply chain risk management practices throughout the life cycle of the system, component, service or asset in each agency’s responsibilities. Text checked in the United States Code, 2024 edition, as of October 2026.

• The System owner shall ensure the controls selected under SR-3b protect against the insertion of counterfeits, unauthorized production, tampering, theft, insertion of malicious software, and poor manufacturing and development practices throughout the system development life cycle, as OMB Circular A-130, Appendix I, section 3.b(8), requires. (SR-3b)

Acquisition strategies, tools and methods (SR-5)

Guidance

NIST’s SR-5 discussion calls the acquisition process an important vehicle to protect the supply chain, and names tools such as obscuring the end use of a component, blind or filtered buys, tamper-evident packaging, and trusted or controlled distribution. It suggests incentives for suppliers that implement controls and are transparent about their practices, contract language prohibiting tainted or counterfeit components, and restricting purchases from untrustworthy suppliers, chosen in light of the supply chain risk assessment (RA-3(1)). Blind buys and controlled distribution suit high-threat environments; most organizations start with authorized sources, contract terms and supplier assessments. The contract terms themselves live in the acquisition security requirements standard (section 4.5); keep them in step with this clause. SP 800-161 Rev. 1, Section 3, covers supply chain risk management in the acquisition process.

• The Chief Information Security Officer shall employ the following acquisition strategies, contract tools and procurement methods to protect against, identify and mitigate supply chain risks: Fill in: acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks Typical: the supply chain terms of the acquisition security requirements standard, including identification of the origin of critical components and flow-down to subcontractors; contract language prohibiting counterfeit or tainted components; purchase of hardware and software only from original manufacturers, their authorized distributors or resellers, or suppliers the supply chain risk management team has assessed; a supplier risk assessment before award as part of source selection for critical components and services; and tamper-evident packaging and tracked delivery for hardware. (SR-5)
• The Chief Information Security Officer shall ensure each acquisition of a component or service that the criticality analysis (RA-9) identifies as critical is reviewed by the supply chain risk management team before award. (SR-5)
• The results of the system’s supply chain risk assessment (RA-3(1)) shall inform the strategies, tools and methods chosen for each such acquisition. (SR-5)

Federal systems

OMB Circular A-130, section 5.d(1)(a), requires agencies, when acquiring information technology, to analyze risks (including supply chain risks) associated with potential contractors and the products and services they provide, and to allocate risk responsibility between Government and contractor. Under 41 U.S.C. § 1323(c)(5) and (7), the Secretary of Homeland Security, the Secretary of Defense and the Director of National Intelligence may issue orders, on the Federal Acquisition Security Council’s recommendation, excluding sources or covered articles from executive agency procurement actions or requiring the removal of covered articles from executive agency information systems, and requires executive agencies to comply with those orders; 41 CFR 201-1.304 repeats the duty and sets out how an agency requests an exception. OMB M-26-05, Adopting a Risk-based Approach to Software and Hardware Security (January 23, 2026), requires agencies to develop software and hardware assurance policies and processes that match their risk determinations and mission needs, and lets them choose to use the Secure Software Development Attestation Form and contract terms requiring a current software bill of materials on request; it names CISA’s hardware bill of materials framework as a reference. Statute checked in the United States Code, 2024 edition, as of October 2026.

• The Chief Information Security Officer shall ensure each acquisition of information technology analyzes the supply chain risks associated with potential contractors and the products and services they provide, and allocates risk responsibility between the Government and the contractor, as OMB Circular A-130, section 5.d(1)(a), requires. (SR-5)
• The Chief Information Security Officer shall track the exclusion and removal orders issued under 41 U.S.C. § 1323(c)(5) that apply to the agency, ensure that procurement actions exclude the sources and covered articles they name, and ensure that system owners remove named covered articles from the agency’s systems, as 41 U.S.C. § 1323(c)(7) and 41 CFR 201-1.304 require. (SR-5)
• The Chief Information Security Officer shall apply the agency’s software and hardware assurance policy under OMB M-26-05 when choosing the strategies, tools and methods for each acquisition. (SR-5)

Supplier assessments and reviews (SR-6)

Guidance

NIST’s SR-6 discussion lists what a supplier review covers: security and supply chain risk management processes; foreign ownership, control or influence; and the supplier’s ability to assess its own second- and third-tier suppliers. Reviews consider documented processes and controls, all-source intelligence and publicly available information, and may be done by the organization or an independent third party. SP 800-161 Rev. 1 adds that assessments should apply a consistent set of core factors and criteria, so suppliers can be compared with each other and over time, and that the sources of information should be documented; its Appendix D.4 is a sample supply chain risk assessment template. For a cloud or other external service, the external service review (SA-9) and the provider’s independent attestation supply much of the evidence. The supplier assessment questionnaire rates the same core risk factors for every supplier and records the source of each finding.

• The Chief Information Security Officer shall assess and review the supply chain-related risks associated with suppliers or contractors and the systems, system components or system services they provide Fill in: the frequency at which to assess and review the supply chain-related risks associated with suppliers or contractors and the systems, system components, or system services they provide Typical: before each contract award or renewal, and annually for suppliers of critical components and services. (SR-6)
• Each assessment shall cover the supplier’s security and supply chain risk management processes, its foreign ownership, control or influence, its ability to assess its own second- and third-tier suppliers, its documented processes and controls, and publicly available information about it. (SR-6)
• The Chief Information Security Officer shall apply the same core risk factors and criteria to every supplier assessment, and record the sources of information each one relied on. (SR-6)
• A contract for a critical component or service shall not be awarded or renewed until its supplier assessment is complete and each risk found is accepted or has a planned response. (SR-6)
• The Chief Information Security Officer shall have the supply chain risk management team monitor publicly available information about the suppliers of critical components and services for indications of stolen information, poor development or quality control practices, information spillage or counterfeits. (SR-6)
• The Chief Information Security Officer shall share assessment and review results with other organizations only as applicable rules, policies, agreements or contracts allow or require. (SR-6)

Federal systems

41 U.S.C. § 1326(a) makes the head of each executive agency responsible for assessing the supply chain risk posed by the acquisition and use of covered articles, and for prioritizing those assessments based on the criticality of the mission, system, component, service or asset. NIST SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (May 2022, updated November 1, 2024; current as of October 2026), Appendix E, gives federal agencies baseline risk factors (section E.2.2) to address, at a minimum, for assessments of critical sources and covered articles, and says (section E.2.1) that determining assessment priorities, evaluating impact and making risk response decisions are inherently governmental functions that cannot be outsourced, although a qualified, vetted third party may support research and documentation. Under 41 CFR 201-1.201(b), an executive agency must expeditiously submit supply chain risk information to the Federal Acquisition Security Council’s information sharing agency when the Council requests it, or when the agency determines there is a reasonable basis to conclude that a substantial supply chain risk exists in connection with a source or covered article. Statute checked in the United States Code, 2024 edition, and regulation in the eCFR, as of October 2026.

• The Chief Information Security Officer shall prioritize supplier assessments by the criticality of the mission, system, component, service or asset, as 41 U.S.C. § 1326(a)(2) requires. (SR-6)
• Assessments of critical sources and covered articles shall address every baseline risk factor in NIST SP 800-161 Rev. 1, Appendix E, section E.2.2. (SR-6)
• Agency officials shall set assessment priorities and make each risk response decision; a contractor may support the research and documentation but shall not make those decisions. (SR-6)
• When the agency determines there is a reasonable basis to conclude that a substantial supply chain risk exists in connection with a source or covered article, the Chief Information Security Officer shall submit the relevant supply chain risk information to the Federal Acquisition Security Council’s information sharing agency, as 41 CFR 201-1.201(b) requires. (SR-6)

Notification agreements (SR-8)

Guidance

NIST’s SR-8 discussion says early notification of compromises and potential compromises in the supply chain is essential to responding to them, and that shared assessment or audit results can help a supply chain entity resolve a concern or improve its processes. SP 800-161 Rev. 1 adds that, at a minimum, organizations should require their suppliers to establish notification agreements with the entities in their own supply chains that have a role in a critical product or service. The notice times belong in the contract: the acquisition security requirements standard (section 4.6) sets them for incidents and vulnerabilities. Notification in the other direction, from the organization to its suppliers about an incident, is the IR-6(3) clause of the Incident Response Policy.

• The Chief Information Security Officer shall establish agreements and procedures with the entities involved in the supply chain for the system, system component or system service for Select one or more: notification of supply chain compromises; [Assignment: organization-defined results of assessments or audits] Typical: notification of supply chain compromises, and the results of assessments or audits. (SR-8)
• Each contract for a critical component or service shall require the supplier to notify the organization of a compromise or suspected compromise in its supply chain that may affect the organization’s systems, within the time the acquisition security requirements standard sets for incident notice. (SR-8)
• Each such contract shall require the supplier to establish notification agreements with the entities in its own supply chain that have a role in the critical component or service. (SR-8)
• The Chief Information Security Officer shall keep a current notification contact for each supplier of a critical component or service, and give each supplier the organization’s contact for supply chain notices. (SR-8)
• The Incident response team shall receive each supplier notification of a compromise and handle it under the incident response plan, with the supply chain risk management team identifying the affected systems and components. (SR-8)

Inspection of systems or components (SR-10)

Guidance

NIST’s SR-10 discussion says inspection addresses physical and logical tampering and applies to systems and components removed from organization-controlled areas. It names the indications of a need for inspection: changes in packaging, specifications, factory location or the entity the part is bought from, and individuals returning from travel to high-risk locations. SP 800-161 Rev. 1 says to inspect critical systems and components at a minimum, before use and periodically after, and to put inspection requirements in contracts with suppliers, integrators and service providers, flowed down to subcontractors. The receipt check in the Physical and Environmental Protection Policy (PE-16) is the first inspection of every arriving component; the component inventory records the result.

• The System owner shall inspect Fill in: systems or system components that require inspection Typical: the components the criticality analysis (RA-9) identifies as critical, and any component that has been outside organization-controlled areas, such as for off-site repair or travel Select one or more: at random; at [Assignment: organization-defined frequency]; upon [Assignment: organization-defined indications of need for inspection] Typical: before first use and annually thereafter, and upon indications of a need for inspection to detect tampering. (SR-10)
• Each inspection shall check for physical tampering, such as broken seals, altered packaging, missing or mismatched labels and serial numbers, and signs a case was opened, and for logical tampering, such as firmware or software that does not match the version and the hash or signature the manufacturer publishes. (SR-10)
• Each inspection shall be recorded with the component, the date, who inspected it and the result. (SR-10)
• A component that shows signs of tampering shall be kept out of service and reported under the incident response plan (IR-6). (SR-10)
• Contracts with the suppliers, integrators and service providers of critical components shall require them to inspect those components for tampering, and to flow the requirement down to their subcontractors. (SR-10)

Component authenticity (SR-11)

Guidance

NIST’s SR-11 discussion names manufacturers, developers, vendors and contractors as sources of counterfeit components, says anti-counterfeit policy and procedures support tamper resistance and protect against malicious code, and names CISA as an external reporting organization. SP 800-161 Rev. 1 says the policy and procedures need input from acquisition, information technology, security, legal and the supply chain risk management team, and should address contract clauses and counterfeit reporting processes, such as the Government-Industry Data Exchange Program (GIDEP), and, where appropriate, qualified bidders or manufacturers lists. The statements below are the anti-counterfeit policy; the procedure sets out the checks for each type of component. SR-11(3), anti-counterfeit scanning, is in no baseline.

• The Chief Information Security Officer shall develop and implement anti-counterfeit procedures that include the means to detect and prevent counterfeit components from entering the system. (SR-11a)
• Hardware, software and firmware shall be obtained only from the original manufacturer, its authorized distributors or resellers, or a source the supply chain risk management team has assessed and approved. (SR-11a)
• Each component shall be checked on receipt against the order and the manufacturer’s identifiers, such as part and serial numbers, labels and packaging. (SR-11a)
• Software, firmware and updates shall be verified by digital signature or the manufacturer’s published hash before installation. (SR-11a)
• A suspected counterfeit component shall be quarantined and kept out of the system until the investigation is complete, and shall not be returned to the seller before then. (SR-11a)
• A counterfeit component found installed in a system shall be handled as an incident under the incident response plan. (SR-11a)
• The Chief Information Security Officer shall report counterfeit system components to Select one or more: source of counterfeit component; [Assignment: organization-defined external reporting organizations]; [Assignment: organization-defined personnel or roles] Typical: the source of the counterfeit component, the original manufacturer and CISA, and the Chief Information Security Officer, the supply chain risk management team and the system owner. (SR-11b)

Anti-counterfeit training (SR-11(1))

• The Chief Information Security Officer shall train Fill in: personnel or roles requiring training to detect counterfeit system components (including hardware, software, and firmware) Typical: staff who receive, inspect, install or repair hardware, procurement staff who buy system components, and the supply chain risk management team to detect counterfeit system components, including hardware, software and firmware. (SR-11(1))
• The training shall be part of role-based training (AT-3), completed before the person takes on the duties and annually thereafter. (SR-11(1))
• The training shall cover the organization’s anti-counterfeit procedures, how to recognize counterfeit or altered hardware, packaging and software, and how to quarantine and report a suspect component. (SR-11(1))

Guidance

NIST gives no discussion for SR-11(1). SP 800-161 Rev. 1 says the supply chain risk management team can help find training resources and decide who needs the training. Record completions in the training record log, as for other role-based training.

Configuration control for component service and repair (SR-11(2))

Guidance

NIST gives no discussion for SR-11(2). SP 800-161 Rev. 1 says configuration control for component service and repair should be integrated into the organization’s configuration control processes, and that component authenticity should be addressed in contracts for servicing and repair. The Maintenance Policy covers approval, sanitization and the check after repair (MA-2); this clause keeps a component under control while it is away and before it returns.

• The System owner shall maintain configuration control over Fill in: system components requiring configuration control Typical: all system components, including servers, network and security devices, storage devices and end-user devices awaiting service or repair, and over serviced or repaired components awaiting return to service. (SR-11(2))
• A component awaiting service or repair, or awaiting return to service, shall be recorded in the component inventory with the status “under maintenance”, and kept in a controlled area or in the custody of an authorized person. (SR-11(2))
• A component sent off site shall be tracked by serial number from departure to return, with the maintenance log recording who had custody of it. (SR-11(2))
• Before a serviced or repaired component returns to service, it shall be checked against its inventory record, inspected for tampering (SR-10), and have its firmware and software verified and its secure baseline configuration restored (CM-2, CM-6). (SR-11(2))
• Contracts for component service and repair shall require genuine replacement parts from the original manufacturer or its authorized channel. (SR-11(2))

Component disposal (SR-12)

Guidance

NIST’s SR-12 discussion says disposal can happen at any point in the life cycle, not only at retirement, and includes methods such as disk cleaning, removal of cryptographic keys and partial reuse of components. Disposal exposes paper and digital documentation, shipping and delivery records, memory sticks with code, and whole routers or servers with permanent media, and proper disposal keeps components out of the gray market. Sanitization itself follows the Media Protection Policy (MP-6); record it in the media sanitization record, and keep the disposed component in the component inventory with the status “disposed”.

• The System owner shall dispose of Fill in: data, documentation, tools, or system components to be disposed of Typical: system components, media and devices that hold or have held organizational information, configurations or credentials; system, design and supply chain documentation, including shipping and delivery records; and development, test and maintenance tools using the following techniques and methods: Fill in: techniques and methods for disposing of data, documentation, tools, or system components Typical: sanitization of storage by the method the media sanitization procedure sets for it (MP-6), removal of cryptographic keys, credentials and licenses, destruction of paper documentation by shredding or incineration, and transfer of hardware only to a disposal or recycling provider under contract that certifies destruction or recycling by serial number. (SR-12)
• These techniques and methods shall apply whenever disposal happens in the life cycle, including during development, testing and maintenance. (SR-12)
• Each disposal of a component shall be recorded with the component’s identifiers, the method, who performed and verified it, the date, and the media sanitization record or the provider’s certificate. (SR-12)
• A component shall not be resold, donated or returned to a lessor or vendor unless its storage has been purged or destroyed as the Media Protection Policy requires and the System owner has approved its release. (SR-12)

Review and update

• The Fill in: an official to manage the development, documentation, and dissemination of the supply chain risk management policy and procedures Typical: Chief Information Security Officer shall review and update this policy Fill in: the frequency at which the current supply chain risk management policy is reviewed and updated Typical: annually and following Fill in: events that require the current supply chain risk management policy to be reviewed and updated Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines. (SR-1c.1)
• The Fill in: an official to manage the development, documentation, and dissemination of the supply chain risk management policy and procedures Typical: Chief Information Security Officer shall review and update the procedures that implement this policy Fill in: the frequency at which the current supply chain risk management procedure is reviewed and updated Typical: annually and following Fill in: events that require the supply chain risk management procedures to be reviewed and updated Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe. (SR-1c.2)

Federal systems

For federal information systems, this policy also carries out the agency’s information security responsibilities under the Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3554, Federal agency responsibilities) and OMB Circular A-130, Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

• Where the agency’s organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (SR-1a.1(b))