NIST 800-53 REV 5 • SUPPLY CHAIN RISK MANAGEMENT
SR-4(3) — Validate as Genuine and Not Altered
Employ the following controls to validate that the system or system component received is genuine and has not been altered: {{ insert: param, sr-4.3_prm_1 }}.
Supplemental Guidance
For many systems and system components, especially hardware, there are technical means to determine if the items are genuine or have been altered, including optical and nanotechnology tagging, physically unclonable functions, side-channel analysis, cryptographic hash verifications or digital signatures, and visible anti-tamper labels or stickers. Controls can also include monitoring for out of specification performance, which can be an indicator of tampering or counterfeits. Organizations may leverage supplier and contractor processes for validating that a system or component is genuine and has not been altered and for replacing a suspect system or component. Some indications of tampering may be visible and addressable before accepting delivery, such as inconsistent packaging, broken seals, and incorrect labels. When a system or system component is suspected of being altered or counterfeit, the supplier, contractor, or original equipment manufacturer may be able to replace the item or provide a forensic capability to determine the origin of the counterfeit or altered item. Organizations can provide training to personnel on how to identify suspicious system or component deliveries.
Practitioner Notes
Validate that system components are genuine (not counterfeit) and have not been altered from their original state.
Example 1: Purchase hardware only from authorized resellers or directly from manufacturers. For critical components like servers and network equipment, use vendor registration and authentication programs (like Cisco's Brand Protection) to verify authenticity.
Example 2: For software, verify digital signatures and compare hashes against the vendor's published values before installation. Use code signing verification tools to confirm the software was signed by the legitimate vendor and has not been modified since signing.