Supply Chain Assurance

Technologies today rely on complex, globally distributed and interconnected supply chain ecosystems to provide highly refined, cost effective, and reusable solutions. Organizations currently lack the ability to readily distinguish between trustworthy and untrustworthy products. Having this ability is a critical foundation of cyber supply chain risk management (C-SCRM).

Helping organizations verify that the internal components of the computing devices they acquire are genuine and have not been tampered with.

For this project, the NCCoE will produce example implementations to demonstrate how organizations can verify that the internal components of their purchased computing devices are genuine and have not been altered during the manufacturing and distribution processes. Additionally, this project will demonstrate how to inspect the processes that verify that components in a computing device match the attributes and measurements declared by the manufacturer.
Status: Soliciting Comments

The NCCoE is following an agile process to make each volume for the Validating the Integrity of Computing Devices project available as a preliminary draft for public comment.

The NCCoE has released Volume C of the Preliminary Draft NIST Cybersecurity Practice Guide 1800-34, Validating the Integrity of Computing Devices. The public comment period for the Volume C (How-to-Guide) Preliminary Draft is now open and will close on January 17th, 2022.

NIST SP 1800-34A: Executive SummaryDocument Version NIST SP 1800-34A: Executive Summary
NIST SP 1800-34B: Approach, Architecture, and Security CharacteristicsDocument Version NIST SP 1800-34B: Approach, Architecture, and Security Characteristics

Project Abstract

Product integrity and the ability to distinguish trustworthy products is a critical foundation of C-SCRM. Authoritative information regarding the provenance and integrity of components provides a strong basis for trust in a computing device whether it is a client device, server, or other technology. The goal of this project is to demonstrate how organizations can verify that the components of their acquired computing devices are genuine and have not been tampered with or otherwise modified throughout the devices’ life cycles.

This project addresses several processes:

  • how to create verifiable descriptions of components and platforms, which may be done by original equipment manufacturers (OEMs), platform integrators, and even information technology (IT) departments.
  • how to verify devices and components within the single transaction between an OEM and a customer.
  • how to verify devices and components at subsequent stages in the system life cycle in the operational environment.

This project will use a combination of commercial off-the-shelf and open-source tools to describe the components of a device in a verifiable manner using cryptography. Future builds of this project may cover other critical phases of C-SCRM.

Product integrity and the ability to distinguish trustworthy products is a critical foundation of cyber supply chain risk management (C-SCRM).

Collaborating Vendors

Organizations participating in this project submitted their capabilities in response to an open call in the Federal Register for all sources of relevant security capabilities from academia and industry (vendors and integrators). The following respondents with relevant capabilities or product components (identified as “Technology Partners/Collaborators” herein) signed a Cooperative Research and Development Agreement to collaborate with NIST in a consortium to build this example solution.

Join the Community of Interest

A Community of Interest (COI) is a group of professionals and advisors that share business insights, technical expertise, challenges, and perspectives to guide NCCoE projects. COIs often include experts, innovators, and everyday users of cybersecurity and privacy technologies. Members typically meet monthly by teleconference. Share your expertise and consider becoming a member of this project's COI.

Request to join
Employee speaking on video call with colleagues on online briefing with laptop at home

Supply Chain Assurance Community of Interest Update

The NCCoE’s Supply Chain Assurance project team and collaborators provided an update on the Validating the Integrity of Computing Devices project during an NCCoE Collaborator Series Webinar on March 18th, 2021. The team discussed the scope of the project and the roles that each collaborator is playing in developing the sample solution.