Navigate

SA-19

SA-19: Component Authenticity

The organization:

a: Develops and implements anti-counterfeit policy and procedures that include the means to detect and prevent counterfeit components from entering the information system; and

b: Reports counterfeit information system components to [one or more of source of counterfeit component/ {{ insert: param, sa-19_prm_2 }} / {{ insert: param, sa-19_prm_3 }} ].

Supplemental

Sources of counterfeit components include, for example, manufacturers, developers, vendors, and contractors. Anti-counterfeiting policy and procedures support tamper resistance and provide a level of protection against the introduction of malicious code. External reporting organizations include, for example, US-CERT.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
None

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to SA-19.

Control	Description
PE-3	The organization: a: Enforces physical access authorizations at [organization-defined entry/exit points to the facility where the information system resides] by; 1: Verifying individual access authorizations before granting access to the facility; and 2: Controlling ingress/egress to the facility using [one or more of {{ insert: param, pe-3_prm_3 }} /guards]; b: Maintains physical access audit logs for [organization-defined entry/exit points]; c: Provides [organization-defined security safeguards] to control access to areas within the facility officially designated as publicly accessible; d: Escorts visitors and monitors visitor activity [organization-defined circumstances requiring visitor escorts and monitoring]; e: Secures keys, combinations, and other physical access devices; f: Inventories [organization-defined physical access devices] every [organization-defined frequency]; and g: Changes combinations and keys [organization-defined frequency] and/or when keys are lost, combinations are compromised, or individuals are transferred or terminated.
SA-12	The organization protects against supply chain threats to the information system, system component, or information system service by employing [organization-defined security safeguards] as part of a comprehensive, defense-in-breadth information security strategy.
SI-7	The organization employs integrity verification tools to detect unauthorized changes to [organization-defined software, firmware, and information].

Enhancements

The controls below (if any) add on to the requirements of SA-19.

Control	Description
SA-19(1)	The organization trains [organization-defined personnel or roles] to detect counterfeit information system components (including hardware, software, and firmware).
SA-19(2)	The organization maintains configuration control over [organization-defined information system components] awaiting service/repair and serviced/repaired components awaiting return to service.
SA-19(3)	The organization disposes of information system components using [organization-defined techniques and methods].
SA-19(4)	The organization scans for counterfeit information system components [organization-defined frequency].

Related CCIs

The CCIs below are tied to SA-19.

CCI	Definition
CCI-003356	The organization develops an anti-counterfeit policy that includes the means to detect counterfeit components from entering the information system.
CCI-003357	The organization develops an anti-counterfeit policy that includes the means to prevent counterfeit components from entering the information system.
CCI-003358	The organization develops anti-counterfeit procedures that include the means to detect counterfeit components from entering the information system.
CCI-003359	The organization develops anti-counterfeit procedures that include the means to prevent counterfeit components from entering the information system.
CCI-003360	The organization implements an anti-counterfeit policy that includes the means to detect counterfeit components from entering the information system.
CCI-003361	The organization implements an anti-counterfeit policy that includes the means to prevent counterfeit components from entering the information system.
CCI-003362	The organization implements anti-counterfeit procedures that include the means to detect counterfeit components from entering the information system.
CCI-003363	The organization implements anti-counterfeit procedures that include the means to prevent counterfeit components from entering the information system.
CCI-003364	The organization reports counterfeit information system components to the source of the counterfeit component, organization-defined external reporting organizations, and/or organization-defined personnel or roles.
CCI-003365	The organization defines the external reporting organizations to which counterfeit information system components are to be reported.
CCI-003366	The organization defines the personnel or roles to whom counterfeit information system components are to be reported.