NIST 800-53 REV 5 • SUPPLY CHAIN RISK MANAGEMENT
SR-4(1) — Identity
Establish and maintain unique identification of the following supply chain elements, processes, and personnel associated with the identified system and critical system components: {{ insert: param, sr-04.01_odp }}.
Supplemental Guidance
Knowing who and what is in the supply chains of organizations is critical to gaining visibility into supply chain activities. Visibility into supply chain activities is also important for monitoring and identifying high-risk events and activities. Without reasonable visibility into supply chains elements, processes, and personnel, it is very difficult for organizations to understand and manage risk and reduce their susceptibility to adverse events. Supply chain elements include organizations, entities, or tools used for the research and development, design, manufacturing, acquisition, delivery, integration, operations, maintenance, and disposal of systems and system components. Supply chain processes include development processes for hardware, software, and firmware; shipping and handling procedures; configuration management tools, techniques, and measures to maintain provenance; personnel and physical security programs; or other programs, processes, or procedures associated with the production and distribution of supply chain elements. Supply chain personnel are individuals with specific roles and responsibilities related to the secure the research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal of a system or system component. Identification methods are sufficient to support an investigation in case of a supply chain change (e.g. if a supply company is purchased), compromise, or event.
Practitioner Notes
Verify the identity of suppliers and their authorized representatives to prevent impersonation or fraud in your supply chain.
Example 1: Before placing orders with new suppliers, verify their business registration, DUNS number, and physical address independently — not just from information they provide. Check the SAM.gov registration for government suppliers.
Example 2: For software suppliers, verify their domain ownership and code signing certificates. When a vendor representative contacts you about a software update or license change, verify their identity through a known, previously established communication channel — not the one they used to contact you.