id: "SR-04(02)" title: "Track and Trace" family: "SR" family_name: "Supply Chain Risk Management" sort_id: "sr-04.02" priority: "P1" implementation_level: "organization" parent: "SR-04" enhancement: True
Statement
Establish and maintain unique identification of the following systems and critical system components for tracking through the supply chain: {{ insert: param, sr-04.02_odp }}.
Guidance
Tracking the unique identification of systems and system components during development and transport activities provides a foundational identity structure for the establishment and maintenance of provenance. For example, system components may be labeled using serial numbers or tagged using radio-frequency identification tags. Labels and tags can help provide better visibility into the provenance of a system or system component. A system or system component may have more than one unique identifier. Identification methods are sufficient to support a forensic investigation after a supply chain compromise or event.
Assessment Objective: the unique identification of {{ insert: param, sr-04.02_odp }} is established for tracking through the supply chain;
Assessment Objective: the unique identification of {{ insert: param, sr-04.02_odp }} is maintained for tracking through the supply chain.
Supply chain risk management policy and procedures
system and services acquisition policy
procedures addressing supply chain protection
procedures addressing the integration of information security requirements into the acquisition process
supply chain risk management plan
list of supply chain elements, processes, and actors (associated with the system, system component, or system service) requiring implementation of unique identification processes, procedures, tools, mechanisms, equipment, techniques, and/or configurations
system security plan
other relevant documents or records
Organizational personnel with system and services acquisition responsibilities
organizational personnel with information security responsibilities
organizational personnel with supply chain protection responsibilities
organizational personnel with responsibilities for establishing and retaining the unique identification of supply chain elements, processes, and actors
Organizational processes for defining, establishing, and retaining unique identification for supply chain elements, processes, and actors
mechanisms supporting and/or implementing the definition, establishment, and retention of unique identification for supply chain elements, processes, and actors