Examine received hardware for vulnerabilities

Status: Live

The organization will develop, disseminate, and review: 1) a process to examine received hardware for vulnerabilities that address purpose, scope, and compliance; and 2) procedures to facilitate implementing the process. [UCF ID 01899]

Supporting and supported controls

This control directly supports:

Acceptance of facilities, technology, and technology services [UCF Control ID 01144]

There are no supporting controls.

Authority documents complied with:

NISPOM - National Industrial Security Program Operating Manual (DoD 5220.22-M) February 26, 2006, February 28, 2006, § 8-302.b; The Standard of Good Practice for Information Security, SM4.3.3, SM4.3.4, SD4.4.4(a), SD4.4.4(b)

US Federal Security Guidance

Hardware must be tested to ensure it is in good working order and does not disrupt the secure operation of the system when it is installed. [§ 8-302.b, NISPOM - National Industrial Security Program Operating Manual (DoD 5220.22-M) February 26, 2006, February 28, 2006]

General Guidance

All new hardware should be examined by appropriate staff to identify any security deficiencies. External assessments from trusted sources also should be used to determine any vulnerabilities. [SM4.3.3, SM4.3.4, SD4.4.4(a), SD4.4.4(b), The Standard of Good Practice for Information Security]