Navigate

SR-10

SR-10: Inspection of Systems or Components

Inspect the following systems or system components [one or more of "at random"/"at {{ insert: param, sr-10_odp.03 }} "/"upon {{ insert: param, sr-10_odp.04 }} "] to detect tampering: [systems or system components that require inspection are defined;].

Supplemental

The inspection of systems or systems components for tamper resistance and detection addresses physical and logical tampering and is applied to systems and system components removed from organization-controlled areas. Indications of a need for inspection include changes in packaging, specifications, factory location, or entity in which the part is purchased, and when individuals return from travel to high-risk locations.

CIA Levels
Confidentiality	low
Integrity	low
Availability	low

Overlays
DAF Baseline

CSF Categories
DE.DP-2

Related Controls

The controls below (if any) were marked by NIST as being related to SR-10.

Control	Description
AT-3	a: Provide role-based security and privacy training to personnel with the following roles and responsibilities: [one of ]: 1: Before authorizing access to the system, information, or performing assigned duties, and [the frequency at which to provide role-based security and privacy training to assigned personnel after initial training is defined;] thereafter; and 2: When required by system changes; b: Update role-based training content [the frequency at which to update role-based training content is defined;] and following [events that require role-based training content to be updated are defined;] ; and c: Incorporate lessons learned from internal or external security incidents or breaches into role-based training.
PM-30	a: Develop an organization-wide strategy for managing supply chain risks associated with the development, acquisition, maintenance, and disposal of systems, system components, and system services; b: Implement the supply chain risk management strategy consistently across the organization; and c: Review and update the supply chain risk management strategy on [the frequency for reviewing and updating the supply chain risk management strategy is defined;] or as required, to address organizational changes.
SI-4	a: Monitor the system to detect: 1: Attacks and indicators of potential attacks in accordance with the following monitoring objectives: [monitoring objectives to detect attacks and indicators of potential attacks on the system are defined;] ; and 2: Unauthorized local, network, and remote connections; b: Identify unauthorized use of the system through the following techniques and methods: [techniques and methods used to identify unauthorized use of the system are defined;]; c: Invoke internal monitoring capabilities or deploy monitoring devices: 1: Strategically within the system to collect organization-determined essential information; and 2: At ad hoc locations within the system to track specific types of transactions of interest to the organization; d: Analyze detected events and anomalies; e: Adjust the level of system monitoring activity when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation; f: Obtain legal opinion regarding system monitoring activities; and g: Provide [system monitoring information to be provided to personnel or roles is defined;] to [personnel or roles to whom system monitoring information is to be provided is/are defined;] [one or more of "as needed"/"{{ insert: param, si-04_odp.06 }} "].
SI-7	a: Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: [one of ] ; and b: Take the following actions when unauthorized changes to the software, firmware, and information are detected: [one of ].
SR-3	a: Establish a process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes of [the system or system component requiring a process or processes to identify and address weaknesses or deficiencies is defined;] in coordination with [supply chain personnel with whom to coordinate the process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes is/are defined;]; b: Employ the following controls to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events: [supply chain controls employed to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events are defined;] ; and c: Document the selected and implemented supply chain processes and controls in [one or more of "security and privacy plans"/"supply chain risk management plan"/"{{ insert: param, sr-03_odp.05 }} "].
SR-4	Document, monitor, and maintain valid provenance of the following systems, system components, and associated data: [systems, system components, and associated data that require valid provenance are defined;].
SR-5	Employ the following acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks: [acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks are defined;].
SR-9	Implement a tamper protection program for the system, system component, or system service.
SR-11	a: Develop and implement anti-counterfeit policy and procedures that include the means to detect and prevent counterfeit components from entering the system; and b: Report counterfeit system components to [one or more of "source of counterfeit component"/"{{ insert: param, sr-11_odp.02 }} "/"{{ insert: param, sr-11_odp.03 }} "].

Enhancements

The controls below (if any) add on to the requirements of SR-10.

Control	Description
No controls

Related CCIs

The CCIs below are tied to SR-10.

CCI	Definition
CCI-005128	Inspect the following systems or system components at random, at organization-defined frequency, and/or upon organization-defined indications of need for inspection to detect tampering.
CCI-005129	Defines the frequency for inspecting systems or system components.
CCI-005130	Defines the indications of need for inspection for detecting tampering.
CCI-005131	Defines the system or system components which will be inspected at random, at organization-defined frequency, and/or upon organization-defined indications of need for inspection to detect tampering.