[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fsr-11":3},{"item":4,"lessons":18,"controls":60,"related":89},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","sr-11","SR-11","Component Authenticity",10,"US National Institute of Standards and Technology (NIST)","**What it asks for.** The organisation must develop and implement anti-counterfeit policy and procedures to detect and prevent counterfeit components from entering the system, and report counterfeit components to the source, external reporting organisations or designated personnel.\n\n**In practice.** This means buying hardware and software from authorised channels, verifying signatures and hashes on software, checking hardware provenance for critical components and having a reporting route when tampering or counterfeits are suspected. Auditors look for procurement rules, verification steps and records of any reported issues. Staff handling hardware intake should know what signs of tampering to look for.\n\n**Common gaps.** Purchases through grey-market resellers or marketplaces to save cost or time bypass these checks. Software integrity verification is often skipped for updates and open source packages. Organisations seldom know where to report a suspected counterfeit.","a. Develop and implement anti-counterfeit policy and procedures that include the means to detect and prevent counterfeit components from entering the system; and\n  b. Report counterfeit system components to [Selection: source of counterfeit component; {{ insert: param, sr-11_odp.02 }} ; {{ insert: param, sr-11_odp.03 }} ].\nDiscussion: Sources of counterfeit components include manufacturers, developers, vendors, and contractors. Anti-counterfeiting policies and procedures support tamper resistance and provide a level of protection against the introduction of malicious code. External reporting organizations include CISA.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56],{"slug":21,"title":22,"published_at":23},"hardware-implant-in-reseller-crypto-wallets-drains-86m","Hardware Implant in Reseller Crypto Wallets Drains $86M","2026-10-13T12:21:47.245+00:00",{"slug":25,"title":26,"published_at":27},"malicious-npm-packages-distribute-weaselbiscuit-stealer-targeting-chrome-extension-data","Malicious npm Packages Distribute WeaselBiscuit Stealer Targeting Chrome Extension Data","2026-09-18T12:21:02.242+00:00",{"slug":29,"title":30,"published_at":31},"malicious-code-injected-into-popular-php-package-via-compromised-github-accounts","Malicious Code Injected into Popular PHP Package via Compromised GitHub Accounts","2026-09-17T18:21:43.066+00:00",{"slug":33,"title":34,"published_at":35},"trojanized-quickfox-vpn-installer-delivers-state-sponsored-backdoor","Trojanized QuickFox VPN Installer Delivers State-Sponsored Backdoor","2026-08-05T08:21:16.411+00:00",{"slug":37,"title":38,"published_at":39},"chaindrop-self-propagating-worm-hijacks-400-npm-packages-via-stolen-credentials","ChainDrop: Self-Propagating Worm Hijacks 400+ npm Packages via Stolen Credentials","2026-08-05T02:20:22.496+00:00",{"slug":41,"title":42,"published_at":43},"compromised-maintainer-account-triggers-massive-npm-supply-chain-attack","Compromised Maintainer Account Triggers Massive npm Supply-Chain Attack","2026-08-05T00:21:27.46+00:00",{"slug":45,"title":46,"published_at":47},"backdoored-wordpress-plugin-highlights-software-supply-chain-risks","Backdoored WordPress Plugin Highlights Software Supply Chain Risks","2026-07-31T14:20:24.25+00:00",{"slug":49,"title":50,"published_at":51},"multi-vector-week-supply-chain-compromise-plugin-cve-exploits-and-destructive-malware-surge","Multi-Vector Week: Supply Chain Compromise, Plugin CVE Exploits, and Destructive Malware Surge","2026-07-13T16:20:57.195+00:00",{"slug":53,"title":54,"published_at":55},"mastra-npm-ecosystem-compromised-via-maintainer-account-takeover","Mastra npm Ecosystem Compromised via Maintainer Account Takeover","2026-06-18T06:20:18.976+00:00",{"slug":57,"title":58,"published_at":59},"hijacked-npm-contributor-account-poisons-144-mastra-packages","Hijacked npm Contributor Account Poisons 144 Mastra Packages","2026-06-17T08:21:44.506+00:00",[61,66,71,76,81,85],{"slug":62,"name":63,"problem":64,"stories":65},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",9,{"slug":67,"name":68,"problem":69,"stories":70},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",6,{"slug":72,"name":73,"problem":74,"stories":75},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",4,{"slug":77,"name":78,"problem":79,"stories":80},"patch-management","Automated patch management","Known holes get closed in days, not months.",2,{"slug":82,"name":83,"problem":84,"stories":80},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",{"slug":86,"name":87,"problem":88,"stories":80},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[90,95,100,104,110,115,120,124],{"family":91,"item":92,"code":93,"title":94,"together":9},"nist-sp","800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",{"family":96,"item":97,"code":98,"title":99,"together":9},"cis","2","Control 2","Inventory and Control of Software Assets",{"family":96,"item":101,"code":102,"title":103,"together":65},"16","Control 16","Application Software Security",{"family":105,"item":106,"code":107,"title":108,"together":109},"gdpr","32","Article 32","Security of processing",8,{"family":111,"item":112,"code":113,"title":114,"together":70},"slsa","overview","SLSA","SLSA (Supply-chain Levels for Software Artifacts)",{"family":96,"item":116,"code":117,"title":118,"together":119},"6","Control 6","Access Control Management",5,{"family":5,"item":121,"code":122,"title":123,"together":119},"ac-2","AC-2","Account Management",{"family":5,"item":125,"code":126,"title":127,"together":75},"sa-12","SA-12","Supply Chain Protection"]