id: "SR-04" title: "Provenance" family: "SR" family_name: "Supply Chain Risk Management" sort_id: "sr-04" priority: "P1" implementation_level: "organization" enhancements: - sr-4.1 - sr-4.2 - sr-4.3 - sr-4.4
Statement
Document, monitor, and maintain valid provenance of the following systems, system components, and associated data: {{ insert: param, sr-04_odp }}.
Guidance
Every system and system component has a point of origin and may be changed throughout its existence. Provenance is the chronology of the origin, development, ownership, location, and changes to a system or system component and associated data. It may also include personnel and processes used to interact with or make modifications to the system, component, or associated data. Organizations consider developing procedures (see SR-1 ) for allocating responsibilities for the creation, maintenance, and monitoring of provenance for systems and system components; transferring provenance documentation and responsibility between organizations; and preventing and monitoring for unauthorized changes to the provenance records. Organizations have methods to document, monitor, and maintain valid provenance baselines for systems, system components, and related data. These actions help track, assess, and document any changes to the provenance, including changes in supply chain elements or configuration, and help ensure non-repudiation of provenance information and the provenance change records. Provenance considerations are addressed throughout the system development life cycle and incorporated into contracts and other arrangements, as appropriate.
Assessment Objective: valid provenance is documented for {{ insert: param, sr-04_odp }};
Assessment Objective: valid provenance is monitored for {{ insert: param, sr-04_odp }};
Assessment Objective: valid provenance is maintained for {{ insert: param, sr-04_odp }}.
Supply chain risk management policy
supply chain risk management procedures
supply chain risk management plan
documentation of critical systems, critical system components, and associated data
documentation showing the history of ownership, custody, and location of and changes to critical systems or critical system components
system architecture
inter-organizational agreements and procedures
contracts
system security plan
privacy plan
personally identifiable information processing policy
other relevant documents or records
Organizational personnel with acquisition responsibilities
organizational personnel with information security and privacy responsibilities
organizational personnel with supply chain risk management responsibilities
Organizational processes for identifying the provenance of critical systems and critical system components
mechanisms used to document, monitor, or maintain provenance