The NCCoE has released the final project description, Validating the Integrity of Computing Devices. Use the button below to view this publication.
Download PDF »This project is moving into the build phase. We are no longer accepting Letters of Interest from technology vendors as part of this project. We have selected several technology collaborators who have signed a Cooperative Research and Development Agreement (CRADA; see an example) with NIST.
The National Cybersecurity Center of Excellence (NCCoE) recently released the final project description: Validating the Integrity of Computing Devices.
Organizations today face the challenge of identifying trustworthy products due to increased risk resulting from compromises in cyber supply chains. Cyber Supply Chain Risk Management is an evolving approach to modernizing information technology (IT) systems, as information and operational technologies rely on complex, globally distributed and interconnected, supply chain ecosystems to provide highly refined, cost-effective, and reusable solutions.
For this project, the NCCoE will produce example implementations to demonstrate how organizations can verify that the internal components of their purchased computing devices are genuine and have not been altered during the manufacturing and distribution processes. Additionally, this project will demonstrate how to inspect the processes that verify that the components in a computing device match the attributes and measurements declared by the manufacturer.
This project will result in a publicly available NIST Cybersecurity Practice Guide, a detailed implementation guide of the practical steps needed to implement a cybersecurity reference architecture model that addresses the challenge.
Organizations participating in this project submitted their capabilities in response to an open call in the Federal Register for all sources of relevant security capabilities from academia and industry (vendors and integrators). The following respondents with relevant capabilities or product components (identified as “Technology Partners/Collaborators” herein) signed a Cooperative Research and Development Agreement to collaborate with NIST in a consortium to build this example solution.
Join Our Community of Interest
Interested in joining the Supply Chain Assurance Community of Interest? Contact us!
A Community of Interest is a group of professionals and technical advisors convened to support the cybersecurity resiliency of the U.S. economy. Read More.
