Component Authenticity SR-11

Source: NIST SP 800-53 Rev.5, Supply Chain Risk Management family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

SR-11 (Component Authenticity) is about keeping counterfeit parts — fake hardware, tampered firmware, or software that only pretends to be a trusted package — out of your system, and having a plan to report a counterfeit if one turns up. It belongs to the Supply Chain Risk Management (SR) family and sits in the Low baseline. The rule of thumb is simple: only run parts you can prove are the real thing, from a source you trust.

What good looks like

• Set a short anti-counterfeit stance: buy hardware only from the manufacturer or an authorized reseller, and install software only from trusted, signed repositories.
• Verify authenticity before use — check digital signatures and serial numbers rather than assuming a part is genuine because it powers on and works.
• Know who to tell if you find a counterfeit: the vendor, plus any reporting body your organization names.
• Keep control of parts that are out for service or repair so a genuine component is not swapped for a fake while it is away (enhancement SR-11(2)).
• Train the people who handle components to recognize the common signs of a counterfeit (enhancement SR-11(1)).

Framework mapping

• NIST CSF 2.0 — ID.RA-09 — The authenticity and integrity of hardware and software are assessed prior to acquisition and use
• CIS Controls v8 — Control 16 — Application Software Security

How to move it toward Implemented

• Lock software to trusted, signed sources: list only official repositories under /etc/apt/sources.list.d/ (or /etc/yum.repos.d/), set gpgcheck=1 on Red Hat-style systems, and remove any repository you cannot tie to a known vendor key.
• Store each vendor’s signing key under /etc/apt/keyrings/ and point to it with Signed-By in the repository file, so an imposter repository cannot pass itself off as the vendor.
• Before installing a downloaded package, verify its signature — rpm --checksig <file>.rpm, or gpg --verify <file>.sig <file> using GPG (GNU Privacy Guard) — and treat an unsigned or badly-signed package as suspect.
• Write a one-page anti-counterfeit note: approved sources for hardware and software, how authenticity is verified, and who to report a counterfeit to — that satisfies the base SR-11 policy-and-reporting requirement.
• Attach that note together with a signature-verification log as hardening evidence on the asset, naming SR-11 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.