# SR-04 Provenance

NIST SP 800-53 control. Family: SR Supply Chain Risk Management. Function: preventative. In no baseline. Mapping licence: CC BY-SA 4.0.

Statement: Document, monitor, and maintain valid provenance of the following systems, system components, and associated data: [Assignment: organization-defined systems, system components, and associated data].
Guidance: Every system and system component has a point of origin and may be changed throughout its existence. Provenance is the chronology of the origin, development, ownership, location, and changes to a system or system component and associated data. It may also include personnel and processes used to interact with or make modifications to the system, component, or associated data. Organizations consider developing procedures (see SR-01) for allocating responsibilities for the creation, maintenance, and monitoring of provenance for systems and system components; transferring provenance documentation and responsibility between organizations; and preventing and monitoring for unauthorized changes to the provenance records. Organizations have methods to document, monitor, and maintain valid provenance baselines for systems, system components, and related data. These actions help track, assess, and document any changes to the provenance, including changes in supply chain elements or configuration, and help ensure non-repudiation of provenance information and the provenance change records. Provenance considerations are addressed throughout the system development life cycle and incorporated into contracts and other arrangements, as appropriate.

## Enhancements (4)
- SR-04(01) Identity
- SR-04(02) Track and Trace
- SR-04(03) Validate as Genuine and Not Altered
- SR-04(04) Supply Chain Integrity — Pedigree
Each enhancement's statement: /api/v1/controls/SR-04?fields=enhancements

## Patterns that use it (5)
- Critical (1): SP-028 Secure DevOps Pipeline Pattern
- Important (2): SP-012 Secure Software Development Lifecycle; SP-040 Post-Quantum Cryptography and Quantum Readiness
- Standard (2): SP-042 Third Party Risk Management; SP-050 Mobile Security Architecture (draft)

## Clauses by framework (28 frameworks)
- iso_27001_2022: A.5.21, A.8.30
- nist_csf_2: ID.RA-09. OSA's own, not in NIST's crosswalk: ID.RA-09
- cis_controls_v8: CIS 16.4, CIS 16.5, CIS 16.11
- iso_42001_2023: A.7.5
- anssi: Hygiene.42, SecNumCloud.16.1
- osfi_b13: B-13.4.1
- finma_circular: V(109), V(110)
- gdpr: Art.28(3)(a), Art.28(3)(h)
- dora: Art.28(5), Art.30(2)(a)
- cra: CRA.II.1
- cbb_tm: TM-15
- qatar_nia: SD
- uae_ia: T10
- bot_cyber: Ch5.1
- ffiec_is: II.C.14
- iosco_cyber: PROT-7
- sebi_cscrf: PR.AS
- fca_sysc_13: SYSC 13.9.2
- fda_cyber: 524B-1, SBOM-1, SBOM-2, SBOM-3, ST-4
- hitrust_csf: 05.b
- lloyds_ms: MS8.8
- nhs_dspt: NDG-10.1, NDG-10.4
- solvency_ii: DR.272, EIOPA-Cloud-GL3
- csa_ccm_v4: TVM-05
- csa_aicm: TVM-05
- mica: Art.66(3)
- basel_sco60: SCO60.54
- bssc: NOS-02
OSA's mapping for iso_27001_2022 and nist_csf_2 takes NIST's published crosswalk as its base. A clause not marked as OSA's own is in that crosswalk.

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/SR-04
- Clauses only: /api/v1/controls/SR-04?fields=mappings
- Page for people: /controls/sr-04/