A chip passes through dozens of organisations before it reaches your rack, and a counterfeit or maliciously modified part can defeat every software control built on top of it. Integrated circuits are designed with third-party tools and IP, fabricated by foundries, packaged and tested elsewhere, sold through distributors and repaired by service partners. Each hand-off is a point where a part can be substituted, remarked or altered. This guide explains hardware Trojans and counterfeit electronic parts, where in the life cycle the risks enter, the procurement rules and assurance programmes that address them (including DFARS, GIDEP reporting and CHIPS for America), and what an enterprise buyer or a product team can actually verify. It is written for supply chain risk, procurement, hardware engineering and security architecture teams. For the software side of the supply chain, see the Software Supply Chain Security Guide.
Key takeaways
- Counterfeits are the everyday risk, Trojans the rare one. Most organisations will meet remarked, recycled or substituted parts long before a malicious circuit; controls for the first also reduce the second.
- Buy from authorised sources. Traceability from the original manufacturer is the most effective single control, and US defence rules require risk-based tracking from manufacturer to acceptance.
- Testing alone cannot prove a chip is clean. Trojans are small, outside specified functionality and designed to stay dormant, so assurance depends on trusted design flows and suppliers as much as on inspection.
- Firmware is part of the hardware supply chain. Updatable firmware and microcode in CPUs, NICs and accelerators carry most of the practical risk an enterprise can review; programmes such as OCP S.A.F.E. publish independent findings.
- Report and quarantine. Suspect parts must be isolated, not returned to the seller, and reported so others can avoid them.
What hardware Trojans and counterfeits are
The CyBOK Hardware Security Knowledge Area describes hardware Trojans as extra logic or gates added to large integrated circuits. They are hard to find because they are not part of the specified functionality and are very small relative to the chip. CyBOK classifies them by three criteria.
| Criterion | Meaning | Defender's question |
|---|---|---|
| Physical characteristics | How the Trojan is inserted, for example by logic changes or by layout-only changes | Who could change the netlist, the layout or the masks? |
| Activation | Whether an internal or external event turns it on (often called the trigger) | Would our tests ever exercise a rare condition or input sequence? |
| Action | What it does once active, such as leaking information or destroying functionality (the payload) | Which assets on this chip, such as keys, would be worth leaking? |
CyBOK also notes concerns that Trojans could be included at board level, not only inside silicon. Counterfeits are defined in procurement law. DFARS 252.246-7007 defines a counterfeit electronic part as an unlawful or unauthorised reproduction, substitution or alteration knowingly mismarked, misidentified or otherwise misrepresented as authentic and from the original manufacturer or an authorised source. A suspect counterfeit part is one where credible evidence, such as visual inspection or testing, provides reasonable doubt that it is authentic.
Common counterfeit types
- Recycled: parts removed from scrapped boards, cleaned and sold as new, with reduced remaining life.
- Remarked: markings changed to claim a higher grade, speed or temperature range, or a different date code.
- Overproduced or out of specification: genuine designs made or sold outside the manufacturer's control, or rejects that failed test.
- Cloned: copies of a design produced without authorisation.
- Substituted components: a different part fitted on an assembly, a pattern MITRE CAPEC records as CAPEC-531 Hardware Component Substitution.
Where risk enters the life cycle
| Stage | Risk | Primary control |
|---|---|---|
| Specification and design | Malicious or flawed third-party IP; compromised EDA tools; insider design changes (CAPEC-443, CAPEC-447) | IP provenance, design reviews, hardware CWE checks, access control on design repositories |
| Fabrication | Mask or layout changes; overproduction | Trusted or accredited foundries for sensitive parts; contractual controls |
| Packaging and test | Rejects released; test results falsified | Supplier audits, test data review |
| Distribution | Recycled and remarked parts; manipulation in transit (CAPEC-439) | Authorised distributors, traceability, tamper-evident packaging |
| Board assembly and integration | Component substitution; added board-level components | Incoming inspection, HBOM comparison, first-article inspection |
| Firmware and updates | Malicious or vulnerable firmware; compromised signing keys | Signed firmware, root of trust verification, independent firmware review |
| Service, repair and disposal | Swapped parts during repair; harvested parts re-entering the market | Configuration control for repair (SR-11(2)), component disposal (SR-12) |
CyBOK points out that design relies on EDA tools, that foundries are mostly in Asia and that testing and packaging happen worldwide, which is why trust and verification across the full design cycle matter for critical infrastructure. Design teams can use the MITRE CWE Hardware Design view (CWE-1194), whose categories include Manufacturing and Life Cycle Management Concerns (CWE-1195), Security Flow Issues (CWE-1196) and Security Primitives and Cryptography Issues (CWE-1205). See the CWE Hardware Weaknesses Guide.
Procurement rules and reporting
US federal rules give the most detailed public model of a counterfeit avoidance programme, and many commercial buyers copy them.
DFARS 252.246-7007 system criteria
The clause (dated January 2023) requires covered defence contractors to operate a counterfeit electronic part detection and avoidance system that addresses twelve criteria:
- Training of personnel.
- Inspection and testing, including acceptance and rejection criteria.
- Processes to abolish counterfeit parts proliferation.
- Risk-based tracking of parts from the original manufacturer to government acceptance.
- Use of suppliers that meet DFARS 252.246-7008.
- Reporting and quarantining of counterfeit and suspect counterfeit parts.
- Methods to identify suspect counterfeits and rapidly confirm them.
- Design, operation and maintenance of the detection and avoidance system.
- Flow-down of requirements to subcontractors.
- Keeping informed of counterfeiting trends.
- Screening GIDEP reports and other credible sources.
- Control of obsolete electronic parts.
Reporting
| Rule | Obligation | Timing |
|---|---|---|
| DFARS 252.246-7007 (c)(6) | Report counterfeit or suspect counterfeit parts to the Contracting Officer and GIDEP; do not return them to the seller or supply chain until shown to be authentic | On becoming aware or having reason to suspect |
| FAR 52.246-26 Reporting Nonconforming Items (August 2024) | Screen GIDEP reports; report counterfeit or suspect counterfeit items, and common items with major or critical nonconformance, to GIDEP and in writing to the Contracting Officer | Within 60 days of becoming aware or having reason to suspect |
Outside government contracting, the same discipline works: a quarantine area, a register of suspect parts, a rule that suspect stock is never sent back to the broker that sold it, and a route to share findings with industry. Aerospace and defence suppliers also use SAE standards such as AS5553 for counterfeit avoidance; obtain the current revision from SAE before relying on its detail.
Industrial policy: CHIPS for America
The CHIPS and Science Act of 2022 provided $50 billion, implemented through two Department of Commerce offices: the CHIPS Program Office, with $39 billion in manufacturing incentives, and the CHIPS Research and Development Office, with $11 billion for research and development. R&D programmes include the National Semiconductor Technology Center, the National Advanced Packaging Manufacturing Program, a CHIPS Manufacturing USA Institute and a metrology programme. Awards continue to be made and amended: in October 2026 NIST announced an agreement to amend GlobalFoundries' award and reallocate up to $955 million towards silicon photonics, silicon-germanium and advanced packaging. For security teams, the practical point is that more domestic and allied capacity widens the choice of known suppliers; it does not remove the need to verify parts. Check the CHIPS site for current programme status before citing figures in procurement policy.
What an enterprise buyer can verify
Few organisations can inspect silicon. Most can control where hardware comes from, what it contains and what firmware it runs.
- Source: buy from the manufacturer or its authorised distributors and resellers; require proof of authorisation and certificates of conformance for brokered parts.
- Bill of materials: ask for a hardware bill of materials. CISA's HBOM Framework for Supply Chain Risk Management gives a consistent naming taxonomy for component attributes, a format for recording component types and guidance on which data fits which use case. See the Hardware and Firmware SBOM Guide.
- Firmware review evidence: OCP S.A.F.E. uses accredited independent Security Review Providers to assess updatable firmware and microcode in CPUs, GPUs, FPGAs, network controllers, accelerators and storage devices, covering boot code integrity, secure boot, recovery, secure updates, provisioning and change of ownership; Security Findings Reports are published on GitHub. Ask whether a device has been reviewed and read the findings.
- Cryptographic identity: devices with a hardware root of trust can prove they are genuine and report measured firmware. Attestation does not detect a Trojan in the root of trust itself, but it does detect substituted boards and unauthorised firmware. See the Hardware Root of Trust Guide.
- Delivery and receipt: tamper-evident packaging, serial number checks against the vendor record, and incoming inspection for high-value or high-risk shipments.
What product and hardware teams can do
- Control IP: keep an inventory of third-party IP blocks with versions and provenance, and review their security documentation.
- Protect the design environment: treat netlists, layouts and EDA tool licences as sensitive assets with access control, change review and logging.
- Verify security properties: use the CWE hardware categories as review checklists, including debug and test access and life cycle states. See the Debug Interfaces Security Guide.
- Use device-unique secrets: CyBOK describes physically unclonable functions (PUFs) that derive device-unique keys from manufacturing variation; weak PUFs such as SRAM PUFs suit key generation with error correction, while some strong PUFs have been broken by machine learning attacks.
- Plan for detection limits: functional tests rarely trigger a dormant Trojan. Research techniques such as comparing side-channel behaviour with trusted reference chips and physical imaging exist but are costly; reserve them for high-assurance programmes.
Where identity fits
Many chips leave the factory with a cryptographic identity: a key pair generated or injected during manufacturing and a certificate signed by the vendor's provisioning CA. That makes the factory provisioning system a high-value machine identity issuer. If an attacker can submit their own certificate request to it, or steal its signing key, they can mint "genuine" identities for cloned or modified parts. When you rely on device certificates for onboarding, ask suppliers how provisioning keys are held (for example in HSMs), how certificate requests from the production line are authenticated and how compromised batches would be revoked. See the Device and IoT Identity Guide.
Decision guidance
| Situation | Proportionate approach |
|---|---|
| General enterprise IT purchasing | Authorised channels, serial verification, firmware signing and update controls, HBOM where available |
| Critical servers and network equipment | Add independent firmware review evidence, attestation at onboarding, controlled repair and return processes |
| Obsolete parts for long-life OT or defence systems | Last-time buys from the manufacturer, approved brokers only with inspection and testing, GIDEP screening |
| Products you design | IP provenance, secure design flow, hardware CWE reviews, trusted foundry and test partners for sensitive designs |
| Small organisations | Avoid grey-market hardware, buy from known resellers and register devices with the manufacturer to check warranty status |
Implementation roadmap
- Classify: identify hardware categories where compromise would be critical (identity infrastructure, network core, OT controllers).
- Set sourcing policy: authorised sources by default, a documented exception process for brokers with mandatory inspection.
- Contract: add traceability, HBOM, notification of counterfeits and firmware review evidence to supplier agreements, and flow them down.
- Inspect: start with serial and documentation checks on all critical deliveries; add physical or electrical testing for brokered parts.
- Quarantine and report: define the suspect parts process before you need it, including who decides authenticity.
- Review: track trends and supplier performance each quarter and adjust inspection levels.
Detection and measurement
- Authorised source share: percentage of critical hardware spend through manufacturer or authorised channels.
- Traceability coverage: percentage of critical deliveries with documentation back to the original manufacturer.
- HBOM coverage: percentage of critical hardware models with an HBOM on file.
- Suspect part rate: suspect counterfeits found per thousand parts inspected, by supplier.
- Reporting timeliness: days from suspicion to report, against the 60-day FAR 52.246-26 limit where it applies.
- Firmware review evidence: percentage of critical device models with an independent firmware security review.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev. 5 | SR-3, SR-4 Provenance, SR-5, SR-6, SR-9 Tamper Resistance and Detection, SR-10 Inspection of Systems or Components | Supply chain controls, provenance, supplier review and inspection |
| NIST SP 800-53 Rev. 5 | SR-11 Component Authenticity with SR-11(1) Anti-counterfeit Training, SR-11(2) Configuration Control for Component Service and Repair, SR-11(3) Anti-counterfeit Scanning; SR-12 Component Disposal | The anti-counterfeit control family |
| NIST CSF 2.0 | GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07, ID.RA-09 | Supplier criticality, contracts, due diligence, monitoring, authenticity before use |
| NIST SP 800-161 Rev. 1 | C-SCRM practices | Programme structure for counterfeit and malicious functionality risk |
| MITRE ATT&CK | T1195.003 Compromise Hardware Supply Chain; T1200 Hardware Additions | Adversary use of the hardware supply chain |
| MITRE CAPEC | CAPEC-439, CAPEC-447, CAPEC-452, CAPEC-531 | Distribution manipulation, design alteration, infected hardware, substitution |
See the NIST SP 800-161 Cyber Supply Chain Risk Management Guide for the programme view.
Common failure patterns
- Buying on price from brokers: shortages push teams to grey-market parts with no traceability, often with no extra inspection.
- Returning suspect parts: sending suspect stock back to the seller for a refund puts it back into circulation; DFARS forbids this for covered contracts.
- Treating firmware as someone else's problem: hardware is accepted on brand alone while its firmware signing keys sit with the OEM; the MSI signing keys leak showed that a breach at one manufacturer can undermine the boot trust of many products.
- Unmanaged repair: field service swaps boards or chips with no record, so the installed configuration no longer matches the HBOM.
- Expecting testing to find Trojans: functional acceptance tests are designed to show the part works, not that it does nothing else.
- Uncontrolled disposal: scrapped equipment is sold intact, and its parts re-enter the market as recycled counterfeits.
Practitioner checklist
- Identify critical hardware categories and their suppliers.
- Make authorised sources the default and inspect any brokered part.
- Put traceability, HBOM and counterfeit notification clauses in supplier contracts and flow them down.
- Ask for independent firmware review evidence for servers, NICs and accelerators.
- Verify device identity and firmware by attestation at onboarding where the hardware supports it.
- Run a quarantine and reporting process for suspect parts, including GIDEP where you are a federal contractor.
- Control repair, return and disposal so parts cannot re-enter the supply chain.
- Train buyers and receiving staff to recognise counterfeit warning signs.
Standards and references
- Acquisition.gov: DFARS 252.246-7007 Contractor Counterfeit Electronic Part Detection and Avoidance System
- Acquisition.gov: FAR 52.246-26 Reporting Nonconforming Items
- NIST: SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- CyBOK: Hardware Security Knowledge Area
- MITRE CWE: CWE-1194 Hardware Design view
- CISA: Hardware Bill of Materials Framework for Supply Chain Risk Management
- Open Compute Project: OCP S.A.F.E. Program
- NIST: CHIPS for America
Related NHI Mgmt Group resources: Software Supply Chain Security Guide · Hardware and Firmware SBOM Guide · Hardware Root of Trust Guide · NIST SP 800-161 Cyber Supply Chain Risk Management Guide