SR-10 asks you to inspect defined systems or system components, at times you set, to detect tampering. NIST 800-53 binds US federal systems and, by contract, some others. For other companies it is mostly a hardware and delivery control, though the logic extends to software artifacts.
What it means in practice
The guidance says the inspection addresses physical and logical tampering and applies to items removed from organization controlled areas. It lists triggers: changes in packaging, specifications, factory location or the entity from which a part is purchased, and individuals returning from travel to high risk locations.
For a laptop fleet that means checking a device that has been out of your control. For software, the analogous check is comparing a received artifact against a known good digest before use.
Evidence to collect
- The list of components subject to inspection and the triggers you chose.
- Inspection checklists and completed records.
- Chain of custody notes for shipped equipment.
- Records of travel related device checks, if you have such a rule.
- For software, verification logs of checksums or signatures.
Common gaps
- Inspection performed informally with no record.
- No trigger for a change of supplier or packaging.
- Travel rules that exist for people but not for their devices.
How to implement it
Write down which assets get inspected and when. Use a one page checklist, store the signed result with the asset record, and add a hash check step for downloaded installers and images.
Quick check
What events can trigger an inspection?
The guidance names packaging changes, specification changes, a different factory location or supplier, and return from travel to high risk locations.
