SR-11

Requirement
1. Develop and implement anti-counterfeit policy and procedures that include the means to detect and prevent counterfeit components from entering the system; and
2. Report counterfeit system components to [Selection (one or more): source of counterfeit component; [Assignment: organization-defined external reporting organizations]; [Assignment: organization-defined personnel or roles]].

Discussion

Sources of counterfeit components include manufacturers, developers, vendors, and contractors. Anti-counterfeiting policies and procedures support tamper resistance and provide a level of protection against the introduction of malicious code. External reporting organizations include CISA.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Supply chain risk management policy and procedures; supply chain risk management plan; system and services acquisition policy; anti-counterfeit plan; anti-counterfeit policy and procedures; media disposal policy; media protection policy; incident response policy; reports notifying developers, manufacturers, vendors, contractors, and/or external reporting organizations of counterfeit system components; acquisition documentation; service level agreements; acquisition contracts for the system, system component, or system service; inter-organizational agreements and procedures; records of reported counterfeit system components; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with system and service acquisition responsibilities; organizational personnel with information security responsibilities; organizational personnel with supply chain risk management responsibilities; organizational personnel with responsibilities for anti-counterfeit policies, procedures, and reporting].

Test

[SELECT FROM: Organizational processes for counterfeit prevention, detection, and reporting; mechanisms supporting and/or implementing anti-counterfeit detection, prevention, and reporting].

ID	Assessment Objectives
SR-11a.[03]	the anti-counterfeit procedures include the means to detect counterfeit components entering the system;
SR-11a.[04]	the anti-counterfeit procedures include the means to prevent counterfeit components from entering the system;
SR-11b.	counterfeit system components are reported to <SR-11_ODP[01] SELECTED PARAMETER VALUES>.
SR-11a.[01]	an anti-counterfeit policy is developed and implemented;
SR-11a.[02]	anti-counterfeit procedures are developed and implemented;

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!