SA-19, Component Authenticity, is withdrawn in NIST SP 800-53 Rev 5 and moved to SR-11. The old enhancements show the scope: SA-19.1 Anti-counterfeit Training, SA-19.2 Configuration Control for Component Service and Repair, SA-19.3 Component Disposal and SA-19.4 Anti-counterfeit Scanning.
800-53 binds US federal systems, and others through contract. For small and mid size companies it is a reference, and SR-11 is the number to cite.
What it means in practice
The question is whether a component is what its label says. For hardware that means counterfeit parts. For software it means a package that is the real one, not a lookalike or a tampered copy.
Evidence to collect
- Records of where components come from.
- Package integrity checks, such as lockfiles with hashes.
- Disposal records for retired hardware.
Common gaps
Pulling packages by name without pinning versions or checking hashes, which leaves room for typosquats and swapped releases.
How to implement it
Pin dependencies with hashes, restrict sources to approved registries, and cite SR-11 in new documents. A dependency scan, such as the free one at gold.safeguard.sh/scan, shows what you actually pulled in.
A small worked example
A developer mistypes a package name and installs a lookalike published last week. A lockfile with hashes and a registry allow list would have blocked it. Without them, the only defense is luck. Showing an auditor the lockfile policy and a blocked install log is stronger than a paragraph of intent.
Quick check
What replaced SA-19?
SR-11, per the Rev 5 catalog.
