Control statement
- a.Develop and implement anti-counterfeit policy and procedures that include the means to detect and prevent counterfeit components from entering the system; and
- b.Report counterfeit system components to [Organization-defined: sr-11_odp.01].
Discussion
Sources of counterfeit components include manufacturers, developers, vendors, and contractors. Anti-counterfeiting policies and procedures support tamper resistance and provide a level of protection against the introduction of malicious code. External reporting organizations include CISA.
Organization-defined parameters
These values must be resolved through the organization’s tailoring and governance process. Bracketed parameter references in the control text identify where a decision is required.
From control text to operational evidence
Use Component Authenticity as a testable risk decision. Translate the official statement into accountable people, repeatable processes, configured technology, and evidence that demonstrates the outcome over time. In this family, pay particular attention to cybersecurity supply-chain governance, provenance, supplier risk, component authenticity, and dependency resilience.
Implementation workflow
- Define the control boundary, responsible owner, inherited portions, and systems or processes in scope.
- Resolve each organization-defined parameter before declaring the control implemented.
- Document how the implementation satisfies every clause of the official control statement.
- Collect evidence as a normal byproduct of operation rather than only before an assessment.
- Review exceptions, changes, and monitoring results on a risk-based cadence.
Evidence examples
- supplier inventories and criticality ratings
- contract security clauses
- provenance and authenticity records
- supplier monitoring and incident records
Common failure patterns
- tier-one vendors assessed while sub-tier dependencies are ignored
- contracts lack evidence and notification obligations
- open-source and service dependencies omitted
- supplier risk reviews occur only at onboarding
Questions practitioners should ask
- What risk decision is this control intended to support in this system?
- Which parts are implemented locally, inherited, shared, or not applicable—and what evidence supports that decision?
- Do the documented narrative, deployed configuration, operating process, and collected evidence agree?
- What event or threshold requires the implementation to be reviewed or changed?
Assessment objectives and methods
Show the assessment objective
- SR-11a.
- SR-11a.[01]an anti-counterfeit policy is developed and implemented;
- SR-11a.[02]anti-counterfeit procedures are developed and implemented;
- SR-11a.[03]the anti-counterfeit procedures include the means to detect counterfeit components entering the system;
- SR-11a.[04]the anti-counterfeit procedures include the means to prevent counterfeit components from entering the system;
- SR-11b.counterfeit system components are reported to [Organization-defined: sr-11_odp.01].
Examine
- Supply chain risk management policy and procedures
- supply chain risk management plan
- system and services acquisition policy
- anti-counterfeit plan
- anti-counterfeit policy and procedures
- media disposal policy
- media protection policy
- incident response policy
- reports notifying developers, manufacturers, vendors, contractors, and/or external reporting organizations of counterfeit system components
- acquisition documentation
- service level agreements
- acquisition contracts for the system, system component, or system service
- inter-organizational agreements and procedures
- records of reported counterfeit system components
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with system and service acquisition responsibilities
- organizational personnel with information security responsibilities
- organizational personnel with supply chain risk management responsibilities
- organizational personnel with responsibilities for anti-counterfeit policies, procedures, and reporting
Test
- Organizational processes for counterfeit prevention, detection, and reporting
- mechanisms supporting and/or implementing anti-counterfeit detection, prevention, and reporting
Related controls
These relationships come from the official OSCAL catalog. They indicate useful dependencies or context, not automatic inheritance or equivalence.
Related NIST SP 800-172 requirements
These Rev. 3 requirements cite this base control or one of its enhancements as a source. The relationship does not by itself determine contractual applicability or complete implementation.
Control enhancements
Enhancements add specificity, strength, or scope to the base control. Baseline badges show explicit selections in the official SP 800-53B OSCAL profiles.
SR-11(1) — Anti-counterfeit Training
Train [Organization-defined: personnel or roles] to detect counterfeit system components (including hardware, software, and firmware).
Official discussion
None.
Organization-defined parameters (1)
Assessment objectives and methods
[Organization-defined: personnel or roles] are trained to detect counterfeit system components (including hardware, software, and firmware).
Examine
- Supply chain risk management policy and procedures
- supply chain risk management plan
- system and services acquisition policy
- anti-counterfeit plan
- anti-counterfeit policy and procedures
- media disposal policy
- media protection policy
- incident response policy
- training materials addressing counterfeit system components
- training records on the detection and prevention of counterfeit components entering the system
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with information security responsibilities
- organizational personnel with supply chain risk management responsibilities
- organizational personnel with responsibilities for anti-counterfeit policies, procedures, and training
Test
- Organizational processes for anti-counterfeit training
Related controls
SR-11(2) — Configuration Control for Component Service and Repair
Maintain configuration control over the following system components awaiting service or repair and serviced or repaired components awaiting return to service: [Organization-defined: system components].
Official discussion
None.
Organization-defined parameters (1)
Assessment objectives and methods
- SR-11(02)[01]configuration control over [Organization-defined: system components] awaiting service or repair is maintained;
- SR-11(02)[02]configuration control over serviced or repaired [Organization-defined: system components] awaiting return to service is maintained.
Examine
- Supply chain risk management policy and procedures
- supply chain risk management plan
- configuration control procedures
- acquisition documentation
- service level agreements
- acquisition contracts for the system component
- inter-organizational agreements and procedures
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with system and services acquisition responsibilities
- organizational personnel with information security responsibilities
- organizational personnel with supply chain risk management responsibilities
Test
- Organizational processes for establishing inter-organizational agreements and procedures with supply chain entities
- organizational configuration control processes
Related controls
SR-11(3) — Anti-counterfeit Scanning
Scan for counterfeit system components [Organization-defined: frequency].
Official discussion
The type of component determines the type of scanning to be conducted (e.g., web application scanning if the component is a web application).
Organization-defined parameters (1)
Assessment objectives and methods
scanning for counterfeit system components is conducted [Organization-defined: frequency].
Examine
- Supply chain risk management policy and procedures
- supply chain risk management plan
- anti-counterfeit policy and procedures
- system design documentation
- system configuration settings and associated documentation
- scanning tools and associated documentation
- scanning results
- procedures addressing supply chain protection
- acquisition documentation
- inter-organizational agreements and procedures
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with system and services acquisition responsibilities
- organizational personnel with information security responsibilities
- organizational personnel with supply chain risk management responsibilities
- organizational personnel with responsibilities for anti-counterfeit policies and procedures
- organizational personnel with responsibility for anti-counterfeit scanning
Test
- Organizational processes for scanning for counterfeit system components
- mechanisms supporting and/or implementing anti-counterfeit scanning
Related controls
Authoritative sources
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. Official control requirements and interpretations remain with NIST and the responsible authorizing organization.