SR-4(3)_validate-as-genuine-and-not-altered

SR-4(3) Validate as Genuine and Not Altered

Enhancement of: SR-4

High-Level Description

Family: Supply Chain Risk Management (SR) Framework: NIST SP 800-53 Rev 5

For many systems and system components, especially hardware, there are technical means to determine if the items are genuine or have been altered, including optical and nanotechnology tagging, physically unclonable functions, side-channel analysis, cryptographic hash verifications or digital signatures, and visible anti-tamper labels or stickers. Controls can also include monitoring for out of specification performance, which can be an indicator of tampering or counterfeits. Organizations may leverage supplier and contractor processes for validating that a system or component is genuine and has not been altered and for replacing a suspect system or component. Some indications of tampering may be visible and addressable before accepting delivery, such as inconsistent packaging, broken seals, and incorrect labels. When a system or system component is suspected of being altered or counterfeit, the supplier, contractor, or original equipment manufacturer may be able to replace the item or provide a forensic capability to determine the origin of the counterfeit or altered item. Organizations can provide training to personnel on how to identify suspicious system or component deliveries.

What to Check

• Verify SR-4(3) Validate as Genuine and Not Altered is documented in SSP
• Confirm control is operating effectively
• Review evidence of continuous monitoring for SR-4(3)
• Verify enhancement builds upon base control SR-4

How to Test

Step 1: Review Documentation

Examine the System Security Plan (SSP) and related artifacts for SR-4(3) implementation details. Verify the organization has documented how this control is satisfied.

Step 2: Validate Implementation

# For cloud environments, use cloud-audit-mcp tools
# For on-premises, review system configurations directly

# Example: Check if account management policies exist
grep -r "account.management\|access.control" /etc/security/ 2>/dev/null

Step 3: Test Operating Effectiveness

Verify the control is actively functioning, not just documented. Check logs, configurations, and operational evidence.

Tools

Remediation Guide

Control Statement

Employ the following controls to validate that the system or system component received is genuine and has not been altered: [organization-defined].

Implementation Guidance

For many systems and system components, especially hardware, there are technical means to determine if the items are genuine or have been altered, including optical and nanotechnology tagging, physically unclonable functions, side-channel analysis, cryptographic hash verifications or digital signatures, and visible anti-tamper labels or stickers. Controls can also include monitoring for out of specification performance, which can be an indicator of tampering or counterfeits. Organizations may leverage supplier and contractor processes for validating that a system or component is genuine and has not been altered and for replacing a suspect system or component. Some indications of tampering may be visible and addressable before accepting delivery, such as inconsistent packaging, broken seals, and incorrect labels. When a system or system component is suspected of being altered or counterfeit, the supplier, contractor, or original equipment manufacturer may be able to replace the item or provide a forensic capability to determine the origin of the counterfeit or altered item. Organizations can provide training to personnel on how to identify suspicious system or component deliveries.

Risk Assessment

CWE Categories

References

• NIST SP 800-53 Rev 5 - SR-4(3)
• NIST SP 800-53A Rev 5 (Assessment Procedures)
• NIST SP 800-53 Rev 5 Full Catalog

Checklist

• Control documented in SSP
• Implementation evidence collected
• Operating effectiveness validated
• Continuous monitoring in place
• Related controls (AT-3, SR-9, SR-10, SR-11) reviewed