Hardware supply chain security in Australia: a practical guide for buyers

A switch, router or PLC can pass through a manufacturer, distributors, a freight company and an integrator before it reaches your rack. Each hand-off is a chance for a part to be swapped, firmware to be changed or a counterfeit to slip in. This guide sets out what Australian government guidance asks of buyers, and the practical checks that keep hardware trustworthy from purchase order to decommissioning.

What can go wrong between the factory and the rack

The US National Institute of Standards and Technology (NIST) gives examples of cyber supply chain risks: counterfeits, unauthorised production, tampering, theft, inserted malicious software and hardware, and poor manufacturing and development practices. NIST applies this across the whole life of a system, from design and distribution through to maintenance and destruction.

For network and OT hardware, those risks fall into four practical groups.

Counterfeits are not a theoretical problem. The US Government Accountability Office set up a fictitious company and requested quotes on two internet platforms selling military-grade electronic parts. None of the 16 parts it received were legitimate: 12 were suspect counterfeits and four were bogus parts supplied against invalid part numbers. GAO notes its sample cannot show how widespread counterfeiting is, but it does show that suspect counterfeits can be bought through online purchasing platforms.

What the ISM expects from buyers

ASD's Information Security Manual (ISM) is a cyber security framework that organisations apply through their own risk management to protect IT and OT systems. Its Guidelines for procurement and outsourcing name IT and OT equipment directly. They ask buyers to consider risk as systems are designed, built, stored, delivered, installed, operated, maintained and decommissioned.

The cyber supply chain controls in the September 2026 edition include:

• ISM-1631: suppliers of IT equipment, OT equipment and related services are identified.
• ISM-1452 and ISM-1567: a supply chain risk assessment is done for those suppliers, and suppliers assessed as high risk are not used.
• ISM-1786 and ISM-1787: an approved supplier list is maintained, and equipment is sourced from approved suppliers.
• ISM-1790: equipment is delivered in a way that maintains its integrity.
• ISM-1791 and ISM-1792: integrity and authenticity are both assessed as part of accepting the product.

The ISM explains why both checks matter:

"a counterfeit product or service securely delivered is still a counterfeit product or service that may not operate as intended or pose a risk to the security of a system."

For more detail, the ISM points to ASD's Cyber supply chain risk management and Identifying cyber supply chain risks publications, and to NIST SP 800-161 Rev. 1 on cyber supply chain risk management.

PSPF, DISP and sector obligations

For outsourced products and services, the ISM points to the Department of Home Affairs' Protective Security Policy Framework (PSPF). In 2024 the Secretary of Home Affairs issued mandatory PSPF directions for Commonwealth entities, requiring them to identify and manage foreign ownership, control or influence (FOCI) risks in technology procurement, and to stocktake internet-facing systems along with their manufacturers and suppliers, as summarised by Clayton Utz.

Defence suppliers have a further layer. The Defence Industry Security Program (DISP) sets minimum governance, personnel, physical and cyber/information security standards for partnering with Defence on projects, contracts and tenders. A hardware receiving process touches the physical, personnel and cyber areas at once, so it is worth documenting well.

Owners of critical infrastructure assets may also have supply chain duties under the SOCI Act. Those are covered in our guide to SOCI Act and CIRMP supply chain obligations.

A receiving and deployment checklist

1. Map who touches the hardware. For each critical device type, list the manufacturer, distributors, resellers, freight carriers and integrators, not just the vendor on the invoice.
2. Assess and approve suppliers. Rate each supplier's risk, drop high-risk ones, and keep an approved supplier list that procurement actually uses.
3. Agree how integrity will be proven. The ISM advises consulting suppliers on how best to confirm the integrity and authenticity of their products. Get that method in writing before the order ships.
4. Protect the shipment. The ISM suggests tracking and tamper-evident packaging for IT and OT equipment.
5. Inspect on receipt. NIST lists inconsistent packaging, broken seals and incorrect labels as signs of tampering that can be spotted before accepting delivery (control SR-4(3) in NIST SP 800-53 Rev. 5). Quarantine anything that fails.
6. Confirm what is inside. Check serial numbers, hardware revisions and components against the order, and firmware versions against the vendor's published release.
7. Load trusted firmware. ISM-1800 asks for network devices to be flashed with trusted firmware before they are used for the first time.
8. Seal and record. Apply tamper-evident seals and record each seal number against the asset, much as the ISM's cable register records seal numbers (ISM-0208).

Counterfeit parts and tamper-evident seals

Counterfeit components

SAE International's AS5553E, revised in November 2025, covers avoiding, detecting, mitigating and disposing of counterfeit electrical, electronic and electromechanical (EEE) parts. It applies to organisations that buy and integrate parts, including maintenance and repair organisations, and its requirements are meant to flow down the supply chain.

NIST control SR-11 asks for anti-counterfeit procedures and for counterfeit components to be reported. Its enhancement SR-11(1) adds training so staff can detect counterfeit hardware, software and firmware. Our guide to counterfeit electronic components covers detection methods.

Tamper-evident seals

NIST's guidance for SR-9 says strong identification combined with tamper resistance or detection is essential to protecting components during distribution and in use. The ISM adds a catch: packaging measures are only beneficial if they are assessed when the product is accepted.

For removable covers on TOP SECRET cable reticulation in shared facilities, the ISM requires uniquely identifiable tamper-evident seals approved by the Security Construction and Equipment Committee (SCEC). Approved products are listed on the Security Equipment Evaluated Products List, with evaluations done by ASIO's T4 Protective Security directorate on the SCEC's behalf. For equipment cases, see our guide to tamper-evident seals for IT and OT equipment.

Repairs, insiders and re-verification

Hardware that passed inspection on day one can be changed later. Maintenance visits and off-site repairs are obvious points of exposure, and the ISM's Guidelines for information technology equipment address both.

Repairs are carried out on site by an appropriately cleared technician (ISM-0305). If that is not possible, the technician is escorted by someone cleared, briefed and familiar enough with the equipment to understand the work (ISM-0306). Afterwards, the equipment is inspected to confirm it keeps its approved configuration and has no unauthorised modifications (ISM-1598).

For network devices, ISM-2161, new in the September 2026 edition, asks for firmware and running configurations to be verified against an approved known-good baseline after patching, when anomalous behaviour is detected, and at least monthly. ASD's Guidelines for networking say this is especially important for internet-facing devices.

NIST control SR-10 offers triggers for physical re-inspection: changes in packaging, specifications, factory location or the entity a part is bought from, and staff returning from travel to high-risk locations. Inspections can also be random or scheduled. For firmware, NIST SP 800-193 frames resilience as protecting firmware from unauthorised changes, detecting changes that occur, and recovering quickly.

Where BoardSafe fits

Most of the steps above depend on knowing whether a board is what it should be. BoardSafe does that check on site. Its scanner compares a circuit board with the board's original design files, flags parts that are fake, swapped or not in the design (such as an extra chip), and checks firmware against a known good version. Each board takes under 60 seconds, and internal testing found 97% of planted faults.

Design files stay with the customer and nothing is sent out. A device that passes gets a small serial-numbered tamper-evident seal across the join of its case. Ongoing assurance includes yearly audits of critical hardware infrastructure and on-site visits for compliance checks and integrity verification, covering shipments and deployments. See how the process works, or read our guide to firmware integrity verification.

Questions people ask