id: "SR-09" title: "Tamper Resistance and Detection" family: "SR" family_name: "Supply Chain Risk Management" sort_id: "sr-09" priority: "P1" implementation_level: "organization" enhancements: - sr-9.1
Statement
Implement a tamper protection program for the system, system component, or system service.
Guidance
Anti-tamper technologies, tools, and techniques provide a level of protection for systems, system components, and services against many threats, including reverse engineering, modification, and substitution. Strong identification combined with tamper resistance and/or tamper detection is essential to protecting systems and components during distribution and when in use.
Assessment Objective
a tamper protection program is implemented for the system, system component, or system service.
Supply chain risk management policy and procedures
supply chain risk management plan
system and services acquisition policy
procedures addressing supply chain protection
procedures addressing tamper resistance and detection
tamper protection program documentation
tamper protection tools and techniques documentation
tamper resistance and detection tools and techniques documentation
acquisition documentation
service level agreements
acquisition contracts for the system, system component, or system service
system security plan
other relevant documents or records
Organizational personnel with tamper protection program responsibilities
organizational personnel with information security responsibilities
organizational personnel with supply chain risk management responsibilities
Organizational processes for the implementation of the tamper protection program
mechanisms supporting and/or implementing the tamper protection program