id: "SA-10(03)" title: "Hardware Integrity Verification" family: "SA" family_name: "System and Services Acquisition" sort_id: "sa-10.03" priority: "P1" implementation_level: "organization" parent: "SA-10" enhancement: True
Statement
Require the developer of the system, system component, or system service to enable integrity verification of hardware components.
Guidance
Hardware integrity verification allows organizations to detect unauthorized changes to hardware components using developer-provided tools, techniques, methods, and mechanisms. Organizations may verify the integrity of hardware components with hard-to-copy labels, verifiable serial numbers provided by developers, and by requiring the use of anti-tamper technologies. Delivered hardware components also include hardware and firmware updates to such components.
Assessment Objective
the developer of the system, system component, or system service is required to enable integrity verification of hardware components.
System and services acquisition policy
procedures addressing system developer configuration management
solicitation documentation
acquisition documentation
service level agreements
acquisition contracts for the system, system component, or system service
system developer configuration management plan
hardware integrity verification records
system security plan
supply chain risk management plan
other relevant documents or records
Organizational personnel with system and service acquisition responsibilities
organizational personnel with information security responsibilities
organizational personnel with configuration management responsibilities
system developers
organizational personnel with supply chain risk management responsibilities
Organizational processes for monitoring developer configuration management
mechanisms supporting and/or implementing the monitoring of developer configuration management