Supply Chain Assurance

Download the Project Description & Comment

The NCCoE has released the draft project descriptionValidating the Integrity of Servers and Client Devices. Use the buttons below to view this publication and provide comments.

Download PDF » Comment »

Current Status

We are seeking your feedback on our recently released draft project description for Validating the Integrity of Servers and Client Devices. Organizations are encouraged to review the draft and provide feedback for possible incorporation into the project description before the public comment period closes on January 6, 2020.

Questions and comments on this publication may be submitted to  supplychain-nccoe@nist.gov.

Summary

Organizations today face the challenge of identifying trustworthy products due to increased risk resulting from compromises in cyber supply chains.  Cyber Supply Chain Risk Management is an evolving approach to modernizing information technology (IT) systems, as information and operational technologies rely on complex, globally distributed and interconnected, supply chain ecosystems to provide highly refined, cost-effective, and reusable solutions.  

For this project, the NCCoE will produce example implementations to demonstrate how organizations can verify that the internal components of their purchased computing devices are genuine and have not been altered during the manufacturing and distribution processes.  Additionally, this project will demonstrate how to inspect the processes that verify that the components in a computing device match the attributes and measurements declared by the manufacturer.

This project will result in a publicly available NIST Cybersecurity Practice Guide, a detailed implementation guide of the practical steps needed to implement a cybersecurity reference architecture model that addresses the challenge.