{"data":{"id":"SR-04","name":"Provenance","family":"SR","family_name":"Supply Chain Risk Management","withdrawn":false,"description":"Document, monitor, and maintain valid provenance of the following systems, system components, and associated data: [Assignment: organization-defined systems, system components, and associated data].","supplemental_guidance":"Every system and system component has a point of origin and may be changed throughout its existence. Provenance is the chronology of the origin, development, ownership, location, and changes to a system or system component and associated data. It may also include personnel and processes used to interact with or make modifications to the system, component, or associated data. Organizations consider developing procedures (see SR-01) for allocating responsibilities for the creation, maintenance, and monitoring of provenance for systems and system components; transferring provenance documentation and responsibility between organizations; and preventing and monitoring for unauthorized changes to the provenance records. Organizations have methods to document, monitor, and maintain valid provenance baselines for systems, system components, and related data. These actions help track, assess, and document any changes to the provenance, including changes in supply chain elements or configuration, and help ensure non-repudiation of provenance information and the provenance change records. Provenance considerations are addressed throughout the system development life cycle and incorporated into contracts and other arrangements, as appropriate.","enhancements":[{"id":"SR-04(01)","name":"Identity","statement":"Establish and maintain unique identification of the following supply chain elements, processes, and personnel associated with the identified system and critical system components: [Assignment: organization-defined supply chain elements, processes, and personnel associated with organization-defined systems and critical system components].","baselines":[]},{"id":"SR-04(02)","name":"Track and Trace","statement":"Establish and maintain unique identification of the following systems and critical system components for tracking through the supply chain: [Assignment: organization-defined systems and critical system components].","baselines":[]},{"id":"SR-04(03)","name":"Validate as Genuine and Not Altered","statement":"Employ the following controls to validate that the system or system component received is genuine and has not been altered: [Assignment: organization-defined controls].","baselines":[]},{"id":"SR-04(04)","name":"Supply Chain Integrity — Pedigree","statement":"Employ [Assignment: organization-defined controls] and conduct [Assignment: organization-defined analysis] to ensure the integrity of the system and system components by validating the internal composition and provenance of critical or mission-essential technologies, products, and services.","baselines":[]}],"baseline_low":false,"baseline_moderate":false,"baseline_high":false,"nist_800_53":{"rev5":{"id":"SR-04","name":"Provenance","description":"Document, monitor, and maintain valid provenance of the following systems, system components, and associated data: [Assignment: organization-defined systems, system components, and associated data].","discussion":"Every system and system component has a point of origin and may be changed throughout its existence. Provenance is the chronology of the origin, development, ownership, location, and changes to a system or system component and associated data. It may also include personnel and processes used to interact with or make modifications to the system, component, or associated data. Organizations consider developing procedures (see SR-01) for allocating responsibilities for the creation, maintenance, and monitoring of provenance for systems and system components; transferring provenance documentation and responsibility between organizations; and preventing and monitoring for unauthorized changes to the provenance records. Organizations have methods to document, monitor, and maintain valid provenance baselines for systems, system components, and related data. These actions help track, assess, and document any changes to the provenance, including changes in supply chain elements or configuration, and help ensure non-repudiation of provenance information and the provenance change records. Provenance considerations are addressed throughout the system development life cycle and incorporated into contracts and other arrangements, as appropriate.","related_controls":["CM-08","MA-02","MA-06","RA-09","SA-03","SA-08","SI-04"],"baseline_low":false,"baseline_moderate":false,"baseline_high":false,"baseline_privacy":false,"new_in_rev5":true,"changes_from_rev4":"New control family introduced in Rev 5"}},"compliance_mappings":{"iso_27001_2022":["A.5.21","A.8.30"],"iso_27002_2022":[],"cobit_2019":[],"pci_dss_v4":[],"nist_csf_2":["ID.RA-09"],"cis_controls_v8":["CIS 16.4","CIS 16.5","CIS 16.11"],"soc2_tsc":[],"finos_ccc":[],"iso_42001_2023":["A.7.5"],"iec_62443":[],"asd_e8":[],"nis2":[],"apra_cps_234":[],"mas_trm":[],"pra_op_resilience":[],"bsi_grundschutz":[],"anssi":["Hygiene.42","SecNumCloud.16.1"],"osfi_b13":["B-13.4.1"],"finma_circular":["V(109)","V(110)"],"gdpr":["Art.28(3)(a)","Art.28(3)(h)"],"dora":["Art.28(5)","Art.30(2)(a)"],"bio2":[],"rbi_csf":[],"fisc":[],"lgpd_bcb":[],"hkma_tme1":[],"mlps_2":[],"dnb_good_practice":[],"cra":["CRA.II.1"],"swift_cscf":[],"cbb_tm":["TM-15"],"qatar_nia":["SD"],"uae_ia":["T10"],"bot_cyber":["Ch5.1"],"ffiec_is":["II.C.14"],"iosco_cyber":["PROT-7"],"sebi_cscrf":["PR.AS"],"nerc_cip":["CIP-010-4","CIP-013-2"],"nrc_73_54":[],"tsa_psd":[],"ieee_1686":[],"ferc_cip":[],"doe_c2m2":[],"api_1164":[],"awia":[],"iaea_nss":[],"pci_pts":[],"fips_140":[],"cbest":[],"tiber_eu":[],"pci_hsm":[],"common_criteria":[],"isae_3402":[],"fca_sysc_13":["SYSC 13.9.2"],"fda_21_cfr_11":[],"fda_cyber":["524B-1","SBOM-1","SBOM-2","SBOM-3","ST-4"],"hitrust_csf":["05.b"],"iso_27799":[],"lloyds_ms":["MS8.8"],"naic_ds":[],"nhs_dspt":["NDG-10.1","NDG-10.4"],"pra_ss1_23":[],"solvency_ii":["DR.272","EIOPA-Cloud-GL3"],"owasp_masvs_v2":[],"csa_ccm_v4":["TVM-05"],"csa_aicm":["TVM-05"],"ccss_v9":[],"mica":["Art.66(3)"],"basel_sco60":["SCO60.54"],"bssc":["NOS-02"],"sec_custody_digital":[],"dpdpa":[],"nist_ai_rmf_1":["MAP 4.1","MANAGE 3.2"],"eu_ai_act":["Art.10(1)-(2)","Art.15(5)","Art.53(1)(d)"]},"metadata":{"last_reviewed":"2026-10-26","review_notes":"2026-10-02: iso_27001_2022 clauses taken from NIST's SP 800-53 Rev 5 to ISO/IEC 27001:2022 crosswalk (OLIR, v1.0.0). OSA had none. 2026-10-03: statement, discussion and related controls taken from NIST SP 800-53 Release 5.2.0, which this file lacked. 2026-10-26: nerc_cip CIP-010-4, CIP-013-2 added from NIST and NERC's SP 800-53 Rev 5.2.0 to NERC CIP crosswalk (OLIR entry 232), which OSA's mapping now takes as its base.","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-012","SP-028","SP-040","SP-041","SP-042","SP-050"],"attack":{"techniques":22,"route":"/api/v1/controls/SR-04?fields=attack"}}}