SA-10(6): Trusted Distribution

Control Family:

System And Services Acquisition

Parent Control:

SA-10: Developer Configuration Management

Priority:

P1: Implement P1 security controls first.

CSF v1.1 References:

PR.DS-8
PR.IP-1
PR.IP-2
PR.IP-3

Threats Addressed:

Tampering

Baselines:

(Not part of any baseline)

Next Version:

NIST Special Publication 800-53 Revision 5.2.0:
SA-10(6): Trusted Distribution

Control Statement

The organization requires the developer of the information system, system component, or information system service to execute procedures for ensuring that security-relevant hardware, software, and firmware updates distributed to the organization are exactly as specified by the master copies.

Supplemental Guidance

The trusted distribution of security-relevant hardware, software, and firmware updates helps to ensure that such updates are faithful representations of the master copies maintained by the developer and have not been tampered with during distribution.