SR-11 asks you to develop and implement anti-counterfeit policy and procedures that detect and prevent counterfeit components from entering the system, and to report counterfeit components to defined recipients. NIST 800-53 binds US federal systems and, by contract, some others. If you buy hardware or run firmware from outside vendors, it is a fair reference.
What it means in practice
The guidance says counterfeits can come from manufacturers, developers, vendors and contractors. Anti-counterfeit policy supports tamper resistance and offers some protection against the introduction of malicious code. External reporting bodies include CISA.
The control has three enhancements: anti-counterfeit training (SR-11.1), configuration control for component service and repair (SR-11.2) and anti-counterfeit scanning (SR-11.3).
For software, the same concern shows up as fake or typosquatted packages and unsigned builds.
Evidence to collect
- The anti-counterfeit policy and procedures.
- Approved supplier lists and purchase from authorized channel records.
- Receiving inspection records.
- Training records for staff who procure or service components.
- A reporting procedure and any reports filed.
Common gaps
- Hardware bought from grey market resellers to save time.
- Repairs performed outside the approved process.
- No path for reporting a suspect part.
How to implement it
Buy from authorized channels, inspect on receipt, and keep a short reporting procedure. For dependencies, verify package names and signatures before adoption.
Quick check
Who might counterfeit components come from?
The guidance lists manufacturers, developers, vendors and contractors.
