sr-4-provenance

name	SR-4_provenance
description	Document, monitor, and maintain valid provenance of the following systems, system components, and associated data: [organization-defined].
category	configuration
version	5.2.0
author	cyberstrike-official
tags	["nist","sp800-53","rev5","sr-4","sr"]
tech_stack	["any"]
cwe_ids	[]
chains_with	["CM-8","MA-2","MA-6","RA-9","SA-3","SA-8","SI-4"]
prerequisites	[]
severity_boost	{"CM-8":"Chain with CM-8 for comprehensive security coverage","MA-2":"Chain with MA-2 for comprehensive security coverage","MA-6":"Chain with MA-6 for comprehensive security coverage"}

SR-4 Provenance

High-Level Description

Family: Supply Chain Risk Management (SR) Framework: NIST SP 800-53 Rev 5

Every system and system component has a point of origin and may be changed throughout its existence. Provenance is the chronology of the origin, development, ownership, location, and changes to a system or system component and associated data. It may also include personnel and processes used to interact with or make modifications to the system, component, or associated data. Organizations consider developing procedures (see SR-1 ) for allocating responsibilities for the creation, maintenance, and monitoring of provenance for systems and system components; transferring provenance documentation and responsibility between organizations; and preventing and monitoring for unauthorized changes to the provenance records. Organizations have methods to document, monitor, and maintain valid provenance baselines for systems, system components, and related data. These actions help track, assess, and document any changes to the provenance, including changes in supply chain elements or configuration, and help ensure non-repudiation of provenance information and the provenance change records. Provenance considerations are addressed throughout the system development life cycle and incorporated into contracts and other arrangements, as appropriate.

What to Check

• Verify SR-4 Provenance is documented in SSP
• Confirm control is operating effectively
• Review evidence of continuous monitoring for SR-4

How to Test

Step 1: Review Documentation

Examine the System Security Plan (SSP) and related artifacts for SR-4 implementation details. Verify the organization has documented how this control is satisfied.

Step 2: Validate Implementation

# For cloud environments, use cloud-audit-mcp tools
# For on-premises, review system configurations directly

# Example: Check if account management policies exist
grep -r "account.management\|access.control" /etc/security/ 2>/dev/null

Step 3: Test Operating Effectiveness

Verify the control is actively functioning, not just documented. Check logs, configurations, and operational evidence.

Tools

Tool	Purpose	Usage
Manual Review	Documentation and interview-based	N/A

Remediation Guide

Control Statement