SR-11—Component Authenticity
>Control Description
Develop and implement anti-counterfeit policy and procedures that include the means to detect and prevent counterfeit components from entering the system; and
Report counterfeit system components to [Selection (one or more): source of counterfeit component; ⚙organization-defined external reporting organizations; ⚙organization-defined personnel or roles].
>DoD Impact Level Requirements
Additional Requirements and Guidance
SR-11 Requirement: CSOs must ensure that their supply chain vendors provide authenticity of software and patches and the vendor must have a plan to protect the development pipeline.
>Discussion
Sources of counterfeit components include manufacturers, developers, vendors, and contractors. Anti-counterfeiting policies and procedures support tamper resistance and provide a level of protection against the introduction of malicious code. External reporting organizations include CISA.
>Programmatic Queries
Related Services
CLI Commands
aws ecr describe-image-scan-findings --repository-name REPO --image-id imageDigest=DIGESTaws signer list-signing-profilesaws codeartifact list-domainsaws signer list-signing-jobs --status Succeeded>Related Controls
>Assessment Interview Topics
Questions assessors commonly ask
Process & Governance:
- •What supply chain risk management policies address SR-11?
- •Who is responsible for managing supply chain risks?
- •How do you assess and monitor risks from suppliers, vendors, and contractors?
- •How do you evaluate and select suppliers based on security criteria?
- •What security requirements are imposed on system developers?
Technical Implementation:
- •What processes ensure that supply chain components meet security requirements?
- •How do you verify the authenticity and integrity of acquired components?
- •What controls prevent counterfeit or malicious components from entering your supply chain?
- •How do you track and verify the provenance of system components?
- •What anti-counterfeit measures are in place?
Evidence & Documentation:
- •Can you provide supply chain risk assessments?
- •What documentation demonstrates supplier compliance with security requirements?
- •Where do you maintain records of supplier assessments and component provenance?
- •Can you provide recent supplier security assessment reports?
- •Can you show component inventory and validation records?
Ask AI
Configure your API key to use AI features.