An error occurred:

CCI-005105

CCI-005105 Definition

Employ the following controls to validate that the system or system component received has not been altered.
Status
Type CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if: - [SR-04(03)_ODP[01]; controls to validate that the system or system component received is genuine are defined] are employed to validate that the system or system component received is genuine. - [SR-04(03)_ODP[02]; controls to validate that the system or system component received has not been altered are defined] are employed to validate that the system or system component received has not been altered.

Validation Procedures

Examine: [SELECT FROM: Supply chain risk management policy and procedures; supply chain risk management plan; system and services acquisition policy; procedures addressing supply chain protection; procedures addressing the security design principle of trusted components used in the specification, design, development, implementation, and modification of the system; system design documentation; procedures addressing the integration of information security requirements into the acquisition process; solicitation documentation; acquisition documentation; service level agreements; acquisition contracts for the system, system component, or system service; evidentiary documentation (including applicable configurations) indicating that the system or system component is genuine and has not been altered; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with system and services acquisition responsibilities; organizational personnel with information security responsibilities; organizational personnel with supply chain risk management responsibilities]. Test: [SELECT FROM: Organizational processes for defining and employing validation safeguards; mechanisms supporting and/or implementing the definition and employment of validation safeguards; mechanisms supporting the application of the security design principle of trusted components in system specification, design, development, implementation, and modification].