# SR-11 Component Authenticity

NIST SP 800-53 control. Family: SR Supply Chain Risk Management. Function: preventative. Baselines: low, moderate, high. Mapping licence: CC BY-SA 4.0.

Statement: a. Develop and implement anti-counterfeit policy and procedures that include the means to detect and prevent counterfeit components from entering the system; and b. Report counterfeit system components to [Selection (one or more): source of counterfeit component; [Assignment: organization-defined external reporting organizations]; [Assignment: organization-defined personnel or roles]].
Guidance: Sources of counterfeit components include manufacturers, developers, vendors, and contractors. Anti-counterfeiting policies and procedures support tamper resistance and provide a level of protection against the introduction of malicious code. External reporting organizations include CISA.

## Enhancements (3)
- SR-11(01) Anti-counterfeit Training. Baselines: low, moderate, high
- SR-11(02) Configuration Control for Component Service and Repair. Baselines: low, moderate, high
- SR-11(03) Anti-counterfeit Scanning
Each enhancement's statement: /api/v1/controls/SR-11?fields=enhancements

## Clauses by framework (30 frameworks)
- iso_27001_2022: A.5.21. OSA's own, not in NIST's crosswalk: A.5.21
- iso_27002_2022: 5.21
- pci_dss_v4: 9.5
- nist_csf_2: ID.RA-09
- cis_controls_v8: CIS 16.5
- iso_42001_2023: A.7.5
- anssi: Hygiene.42, SecNumCloud.16.1
- osfi_b13: B-13.4.1
- gdpr: Art.28(3)(h), Art.30(2)(d)
- dora: Art.28(5), Art.30(2)(a)
- bio2: 5.21
- rbi_csf: Annex1.6
- cbb_tm: TM-15
- nca_ecc: 4-1
- uae_ia: T10
- cpmi_pfmi: CG.PR
- ffiec_is: II.C.14
- iosco_cyber: PROT-7
- nerc_cip: CIP-013-2
- nrc_73_54: RG5.71-C-SR
- ferc_cip: Order 850
- api_1164: Sec 12
- iaea_nss: Sec 6
- pci_pts: A, G
- pci_hsm: 2
- iso_27799: 15.2, H.3
- nhs_dspt: NDG-10.4
- solvency_ii: DR.272
- mica: Art.66(3)
- basel_sco60: SCO60.54
OSA's mapping for iso_27001_2022 and nist_csf_2 takes NIST's published crosswalk as its base. A clause not marked as OSA's own is in that crosswalk.

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/SR-11
- Clauses only: /api/v1/controls/SR-11?fields=mappings
- Page for people: /controls/sr-11/
- Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.