SR-11(2)

Requirement

Maintain configuration control over the following system components awaiting service or repair and serviced or repaired components awaiting return to service: [Assignment: organization-defined system components].

Title

Component Authenticity | Configuration Control for Component Service and Repair
Family

Supply Chain Risk Management
NIST 800-53B Baseline(s)
- Low
- Moderate
- High

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Supply chain risk management policy and procedures; supply chain risk management plan; configuration control procedures; acquisition documentation; service level agreements; acquisition contracts for the system component; inter-organizational agreements and procedures; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with system and services acquisition responsibilities; organizational personnel with information security responsibilities; organizational personnel with supply chain risk management responsibilities].

Test

[SELECT FROM: Organizational processes for establishing inter-organizational agreements and procedures with supply chain entities; organizational configuration control processes].

ID	Assessment Objectives
SR-11(02)[01]	configuration control over <SR-11(02)_ODP system components> awaiting service or repair is maintained;
SR-11(02)[02]	configuration control over serviced or repaired <SR-11(02)_ODP system components> awaiting return to service is maintained.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!