Scope boundary

Owns physical receipt authenticity, exact asset identity, tamper inspection, and custody-chain verification before hardware installation. It excludes supplier questionnaires and does not perform technical boot attestation or patch management.

AID-H-003.004: AID-H-009.003 proves physical receipt and custody authenticity; AID-H-003.004 verifies measured hardware and firmware state and makes technical cluster admission decisions. A valid shipment record does not establish the current runtime measurement.

AID-H-009.001: AID-H-009.003 verifies the component's physical identity and custody before installation; AID-H-009.001 verifies its rooted boot chain after installation. Custody and secure boot address different points in the hardware lifecycle.

Implementation guidance

• AID-H-009.003-G001: Verify every received component against the approved asset record, manufacturer authenticity evidence, physical inspection profile, and tamper-evident custody log before installation.

AID-H-009.003-G001

Concept:

Assume that even trusted supply chains can be compromised. Implement a technical and physical verification process for all new hardware before it is installed in a server.

Step 1: Maintain a mandatory receipt-verification artifact

Your hardware engineering team should execute the same checks for every new accelerator card and record the result in a receipt log.

# File: hardware_receipt_checks/gpu_accelerator_verification.yaml
asset_type: gpu_accelerator
required_checks:
  - check_id: physical_inspection
    description: compare the board against approved vendor photos and inspect for damage or extra components
  - check_id: serial_verification
    description: confirm the physical serial number matches packaging and shipping records
  - check_id: quarantine_power_on
    description: boot the device only in an isolated test bench before production use
  - check_id: firmware_hash_verification
    description: compare installed firmware hash against the vendor-published baseline
release_rule: all_checks_must_pass

Action: Develop a mandatory hardware verification checklist. All new AI accelerators must pass physical inspection and firmware verification in a quarantined environment before approval for deployment.

Verify safely

A separately credentialed verifier independently reads back or replays each received device under its signed product/serial/firmware/component acceptance profile, exercises positive, negative, boundary and dependency-failure fixtures, and reconciles the complete eligible population.

Open-source tools

• paccor (TCG Platform Certificate creation and validation)

Commercial / hosted tools

• Eclypsium
• Intel Transparent Supply Chain Local Verify Tool
• Dell Secured Component Verification (SCV)

Threat mappings

MITRE ATLAS

• AML.T0010 AI Supply Chain Compromise
• AML.T0010.000 AI Supply Chain Compromise: Hardware

MAESTRO

• Supply Chain Attacks (Cross-Layer)

OWASP LLM Top 10 2026

• LLM04:2026 Supply Chain

OWASP ML Top 10 2023

• N/A

OWASP Top 10 for Agentic Applications 2026

• N/A

NIST Adversarial Machine Learning 2025

• N/A

Cisco Integrated AI Security and Safety Framework

• N/A

Google Secure AI Framework 2.0 - Risks

• N/A

Databricks AI Security Framework 3.0

• N/A