| name | SR-4(1)_identity |
| description | Establish and maintain unique identification of the following supply chain elements, processes, and personnel associated with the identified system an |
| category | configuration |
| version | 5.2.0 |
| author | cyberstrike-official |
| tags | ["nist","sp800-53","rev5","sr-4-1","sr","enhancement"] |
| tech_stack | ["any"] |
| cwe_ids | [] |
| chains_with | ["IA-2","IA-8","PE-16"] |
| prerequisites | ["SR-4"] |
| severity_boost | {"IA-2":"Chain with IA-2 for comprehensive security coverage","IA-8":"Chain with IA-8 for comprehensive security coverage","PE-16":"Chain with PE-16 for comprehensive security coverage"} |
SR-4(1) Identity
Enhancement of: SR-4
High-Level Description
Family: Supply Chain Risk Management (SR)
Framework: NIST SP 800-53 Rev 5
Knowing who and what is in the supply chains of organizations is critical to gaining visibility into supply chain activities. Visibility into supply chain activities is also important for monitoring and identifying high-risk events and activities. Without reasonable visibility into supply chains elements, processes, and personnel, it is very difficult for organizations to understand and manage risk and reduce their susceptibility to adverse events. Supply chain elements include organizations, entities, or tools used for the research and development, design, manufacturing, acquisition, delivery, integration, operations, maintenance, and disposal of systems and system components. Supply chain processes include development processes for hardware, software, and firmware; shipping and handling procedures; configuration management tools, techniques, and measures to maintain provenance; personnel and physical security programs; or other programs, processes, or procedures associated with the production and distribution of supply chain elements. Supply chain personnel are individuals with specific roles and responsibilities related to the secure the research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal of a system or system component. Identification methods are sufficient to support an investigation in case of a supply chain change (e.g. if a supply company is purchased), compromise, or event.
What to Check
How to Test
Step 1: Review Documentation
Examine the System Security Plan (SSP) and related artifacts for SR-4(1) implementation details. Verify the organization has documented how this control is satisfied.
Step 2: Validate Implementation
# For cloud environments, use cloud-audit-mcp tools
# For on-premises, review system configurations directly
# Example: Check if account management policies exist
grep -r "account.management\|access.control" /etc/security/ 2>/dev/null
Step 3: Test Operating Effectiveness
Verify the control is actively functioning, not just documented. Check logs, configurations, and operational evidence.
