# SR-10 Inspection of Systems or Components

NIST SP 800-53 control. Family: SR Supply Chain Risk Management. Function: preventative. Baselines: low, moderate, high. Mapping licence: CC BY-SA 4.0.

Statement: Inspect the following systems or system components [Selection (one or more): at random; at [Assignment: organization-defined frequency], upon [Assignment: organization-defined indications of need for inspection]] to detect tampering: [Assignment: organization-defined systems or system components].
Guidance: The inspection of systems or systems components for tamper resistance and detection addresses physical and logical tampering and is applied to systems and system components removed from organization-controlled areas. Indications of a need for inspection include changes in packaging, specifications, factory location, or entity in which the part is purchased, and when individuals return from travel to high-risk locations.

## Patterns that use it (3)
- Standard (3): SP-031 Security Monitoring and Response; SP-034 Cyber Resilience; SP-036 Incident Response

## Clauses by framework (23 frameworks)
- iso_27002_2022: 5.21
- pci_dss_v4: 9.5
- nist_csf_2: GV.SC-05, ID.RA-09
- iso_42001_2023: A.6.2.4
- anssi: Hygiene.31, Hygiene.42, SecNumCloud.16.2
- osfi_b13: B-13.4.1
- finma_circular: VII.A(113), VII.B(114)
- gdpr: Art.28(3)(h)
- dora: Art.28(6)
- bio2: 5.21
- rbi_csf: Annex1.18
- cbb_tm: TM-15
- uae_ia: T10
- ffiec_is: II.C.14
- iosco_cyber: PROT-7
- iaea_nss: Sec 6
- pci_pts: A, G, I
- pci_hsm: 2
- fca_sysc_13: SYSC 13.9.3
- lloyds_ms: MS8.8
- nhs_dspt: NDG-10.4
- solvency_ii: Art.49(2), DR.272, EIOPA-Cloud-GL7
- basel_sco60: SCO60.54
OSA's mapping for nist_csf_2 takes NIST's published crosswalk as its base. A clause not marked as OSA's own is in that crosswalk.

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/SR-10
- Clauses only: /api/v1/controls/SR-10?fields=mappings
- Page for people: /controls/sr-10/
- Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.