ComplianceNIST 800-53 control

NIST-SR-4 Provenance

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
SR Supply Chain Risk Management
Control
SR-4
ATT&CK techniques mitigated
22

Control statement

Document, monitor, and maintain valid provenance of the following systems, system components, and associated data: [Assignment: systems, system components, and associated data].

Discussion

Every system and system component has a point of origin and may be changed throughout its existence. Provenance is the chronology of the origin, development, ownership, location, and changes to a system or system component and associated data. It may also include personnel and processes used to interact with or make modifications to the system, component, or associated data. Organizations consider developing procedures (see [SR-1](#sr-1) ) for allocating responsibilities for the creation, maintenance, and monitoring of provenance for systems and system components; transferring provenance documentation and responsibility between organizations; and preventing and monitoring for unauthorized changes to the provenance records. Organizations have methods to document, monitor, and maintain valid provenance baselines for systems, system components, and related data. These actions help track, assess, and document any changes to the provenance, including changes in supply chain elements or configuration, and help ensure non-repudiation of provenance information and the provenance change records. Provenance considerations are addressed throughout the system development life cycle and incorporated into contracts and other arrangements, as appropriate.

ATT&CK mappings (CTID)

• T1041 Exfiltration Over C2 Channel • T1048 Exfiltration Over Alternative Protocol • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol • T1052 Exfiltration Over Physical Medium • T1052.001 Exfiltration over USB • T1059.002 AppleScript • T1195 Supply Chain Compromise • T1195.001 Compromise Software Dependencies and Development Tools • T1195.002 Compromise Software Supply Chain • T1195.003 Compromise Hardware Supply Chain • T1204.003 Malicious Image • T1505 Server Software Component • T1505.001 SQL Stored Procedures • T1505.002 Transport Agent • T1505.004 IIS Components • T1546.006 LC_LOAD_DYLIB Addition • T1554 Compromise Host Software Binary • T1567 Exfiltration Over Web Service • T1601 Modify System Image • T1601.001 Patch System Image • T1601.002 Downgrade System Image

Related

Mitigates · MITRE ATT&CK (22)

  • T1505.004 IIS Components sub-technique
  • T1204.003 Malicious Image sub-technique
  • T1601 Modify System Image technique
  • T1601.001 Patch System Image sub-technique
  • T1601.002 Downgrade System Image sub-technique
  • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol sub-technique
  • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol sub-technique
  • T1052.001 Exfiltration over USB sub-technique
  • T1195.001 Compromise Software Dependencies and Development Tools sub-technique
  • T1195.002 Compromise Software Supply Chain sub-technique
  • T1195.003 Compromise Hardware Supply Chain sub-technique
  • T1059.002 AppleScript sub-technique
  • T1567 Exfiltration Over Web Service technique
  • T1554 Compromise Host Software Binary technique
  • T1546.006 LC_LOAD_DYLIB Addition sub-technique
  • T1505.001 SQL Stored Procedures sub-technique
  • T1505.002 Transport Agent sub-technique
  • T1505 Server Software Component technique
  • T1195 Supply Chain Compromise technique
  • T1041 Exfiltration Over C2 Channel technique
  • T1048 Exfiltration Over Alternative Protocol technique
  • T1052 Exfiltration Over Physical Medium technique

Related control · Compliance (7)

  • NIST-CM-8 System Component Inventory NIST 800-53 control
  • NIST-MA-2 Controlled Maintenance NIST 800-53 control
  • NIST-MA-6 Timely Maintenance NIST 800-53 control
  • NIST-RA-9 Criticality Analysis NIST 800-53 control
  • NIST-SA-3 System Development Life Cycle NIST 800-53 control
  • NIST-SA-8 Security and Privacy Engineering Principles NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

Referenced by Compliance · enhancement of (4)

  • NIST-SR-4(1) Identity NIST 800-53 enhancement
  • NIST-SR-4(2) Track and Trace NIST 800-53 enhancement
  • NIST-SR-4(3) Validate as Genuine and Not Altered NIST 800-53 enhancement
  • NIST-SR-4(4) Supply Chain Integrity — Pedigree NIST 800-53 enhancement

Referenced by Compliance · has member (1)

  • NIST-SR Supply Chain Risk Management NIST 800-53 family

Referenced by Compliance · related control (19)

  • NIST-CM-8 System Component Inventory NIST 800-53 control
  • NIST-MA-2 Controlled Maintenance NIST 800-53 control
  • NIST-MA-6 Timely Maintenance NIST 800-53 control
  • NIST-PE-16 Delivery and Removal NIST 800-53 control
  • NIST-PL-2 System Security and Privacy Plans NIST 800-53 control
  • NIST-PM-30 Supply Chain Risk Management Strategy NIST 800-53 control
  • NIST-PM-31 Continuous Monitoring Strategy NIST 800-53 control
  • NIST-SA-10 Developer Configuration Management NIST 800-53 control
  • NIST-SA-15 Development Process, Standards, and Tools NIST 800-53 control
  • NIST-SA-24 Design For Cyber Resiliency NIST 800-53 control
  • NIST-SA-3 System Development Life Cycle NIST 800-53 control
  • NIST-SA-8 Security and Privacy Engineering Principles NIST 800-53 control
  • NIST-SA-9(5) Processing, Storage, and Service Location NIST 800-53 enhancement
  • NIST-SA-9(8) Processing and Storage Location — U.S. Jurisdiction NIST 800-53 enhancement
  • NIST-SI-4(17) Integrated Situational Awareness NIST 800-53 enhancement
  • NIST-SI-6(3) Report Verification Results NIST 800-53 enhancement
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control
  • NIST-SR-10 Inspection of Systems or Components NIST 800-53 control
  • NIST-SR-9 Tamper Resistance and Detection NIST 800-53 control