K07 · evidence-bundled critical-infrastructure assurance

Supplier and product due diligence

Direct answer

Supplier and product due diligence provides bounded component or provenance evidence and must be combined with authenticity, installed-state, vulnerability, custody, and recovery evidence.

Stable record: SCA-K07-006
Claim status: PROJECT TECHNICAL PROPOSAL
Last reviewed: 2026-08-16
Research cutoff: 2026-08-16
Source type: GOVERNED PROJECT KNOWLEDGE
Currentness: Current for release 2.1.0; external sources require periodic revalidation.
Correction state: No unresolved public correction recorded for this release.
Machine record: Static JSON record

Authority and evidence boundary. K07 publishes knowledge architecture, bounded reference records, procurement structures, local validation tools, signed synthetic fixtures, and point-in-time source review. It does not certify a facility, award a contract, authorize an operation, prove truth, establish deployment, or claim current operation.

Artifact class

Supply-chain record
Stable ID	`SCA-K07-006`
Artifact type	DUE-DILIGENCE-RECORD

Required fields

supplier identity and ownership
product criticality
security and quality history
vulnerability handling
development and manufacturing locations where authorized
subcontractor dependencies
business continuity
foreign ownership, control or influence when applicable

Validation expectations

official and independent source review
conflict and adverse-event search
contract representation check
periodic revalidation
material-change trigger

Limitations

public information may be incomplete
absence of adverse evidence is not proof of low risk
legal and intelligence review may require authorized channels

Source relationships

NIST SP 1326 — Cybersecurity Supply Chain Risk Management Due Diligence Assessment Quick-Start Guide — National Institute of Standards and Technology; Final; FINAL. Exact claim-support entries: 1. Revalidated 2026-08-15T23:30:00Z.
NIST SP 800-161 Revision 1 Update 1 — Cybersecurity Supply Chain Risk Management Practices — National Institute of Standards and Technology; Revision 1 Update 1; FINAL. Exact claim-support entries: 1. Revalidated 2026-08-15T23:30:00Z.

Assurance boundary

Inventory, signature, attestation, supplier status, vulnerability status, and installed configuration remain separate evidence properties. This record does not certify a product or prove that a deployed asset matches its declared bill of materials.