Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
SA-19 COMPONENT AUTHENTICITY
Overview
| Number | Title | Impact | Priority | Subject Area |
|---|---|---|---|---|
| SA-19 | Component Authenticity | P0 | System And Services Acquisition |
| Instructions |
|---|
| The organization: SA-19a. Develops and implements anti-counterfeit policy and procedures that include the means to detect and prevent counterfeit components from entering the information system; and SA-19b. Reports counterfeit information system components to Selection (one or more): source of counterfeit component; Assignment: organization-defined external reporting organizations; Assignment: organization-defined personnel or roles. |
| Guidance |
|---|
| Sources of counterfeit components include, for example, manufacturers, developers, vendors, and contractors. Anti-counterfeiting policy and procedures support tamper resistance and provide a level of protection against the introduction of malicious code. External reporting organizations include, for example, US-CERT. |
| Enhancements | ||||||||
|---|---|---|---|---|---|---|---|---|
The organization trains Assignment: organization-defined personnel or roles to detect counterfeit information system components (including hardware, software, and firmware).
The organization maintains configuration control over Assignment: organization-defined information system components awaiting service/repair and serviced/repaired components awaiting return to service.
The organization disposes of information system components using Assignment: organization-defined techniques and methods.
The organization scans for counterfeit information system components Assignment: organization-defined frequency. |