BS ISO/IEC 20243:2015 pdf download-Information Technology — Open Trusted Technology ProviderTM Standard (O-TTPS) — Mitigating maliciously tainted and counterfeit products.
2.2.2 Objectives and Benefits The technology supply chain continues to become more globalized, segmented, and specialized. All commercial and government acquirers, integrators, software developers, hardware providers, and manufacturers are members of the global technology supply chain. Consequently, every member of this global community has a responsibility to ensure the security of the end-to-end technology supply chain. The Open Group Trusted Technology Forum (OTTF) is intended to facilitate the evolution of the O-TTPF (Framework) and O-TTPF-related Standards to allow compliant providers to address the ever-changing supply chain landscape and new threats as they emerge. The OTTF also intends to provide an accreditation program that will allow providers who meet the O-TTPS requirements and recommendations to become accredited and acknowledged on a public accreditation registry, so that customers from industry and government can buy from those Trusted Technology Providers with increased confidence. The Forum’s work is intended to benefit: Providers: Providers who adopt these practices will be better able to identify and mitigate security risks throughout the development, sourcing, and maintenance of COTS ICT products. They will be able to take advantage of a market differentiator associated with Trusted Technology Provider status, and to more readily identify Trusted Technology Providers for their own supplier and business partner relationships.
2.3 Recognizing the COTS ICT Context It is important in defining this Standard of best practice requirements and recommendations, to outline the COTS ICT context and limitations. Identifying self-imposed and practical limitations enables businesses to focus upon making improvements in those critical areas that will help to deliver the practical improvements at the heart of this Standard. Clearly stating such limitations is essential to avoiding effort not focused on tangible improvements; for example: Addressing unsolvable problems Allowing scope to creep beyond succinctly constructed problem statements Equally important to optimizing this Standard is limiting focus to those supply chain risks that are specifically associated with a targeted supply chain attack. There is a clear difference between the variety of supply chain business risks (e.g., a supplier going out of business or selling a bad product) and those risks associated with a targeted supply chain attack (e.g., someone maliciously corrupting a component within a product being sold). Two of the principal targeted attack areas relate to tainted and counterfeit products. Suppliers and customers should rightly be concerned about these areas and they are discussed in Chapter 3 of this Standard. A focus on best practices in these risk areas is likely to lead to the critical improvements that both buyers and sellers want, and an improved global market encompassing trustworthy suppliers and trustworthy products.