NIST 800-53 REV 5 • SUPPLY CHAIN RISK MANAGEMENT
SR-10 — Inspection of Systems or Components
Inspect the following systems or system components {{ insert: param, sr-10_odp.02 }} to detect tampering: {{ insert: param, sr-10_odp.01 }}.
Supplemental Guidance
The inspection of systems or systems components for tamper resistance and detection addresses physical and logical tampering and is applied to systems and system components removed from organization-controlled areas. Indications of a need for inspection include changes in packaging, specifications, factory location, or entity in which the part is purchased, and when individuals return from travel to high-risk locations.
Practitioner Notes
Inspect systems or components — physically or logically — to detect tampering, counterfeit components, or unauthorized modifications.
Example 1: When receiving new IT equipment, perform receiving inspections. Verify serial numbers match purchase orders, check for tamper-evident seal integrity, compare the firmware version against the vendor's published current version, and look for physical signs of modification.
Example 2: For software, conduct integrity verification before deployment. Compare file hashes against vendor-published values, verify code signatures, and scan for known malware. Do not deploy any software that fails integrity verification.