To save money, a team bought network switches from an unvetted online reseller, and an inspection later found counterfeit units running modified firmware. Which asset management control would most directly have prevented this?

Acquisition and procurement is where an organization controls what enters its environment. Requiring purchases through vetted, authorized suppliers, and verifying authenticity on receipt by checking serial numbers with the manufacturer, inspecting firmware signatures and confirming tamper-evident packaging, addresses supply chain risks such as counterfeit hardware and malicious firmware before devices are deployed. Assigning each switch to an owner and recording it in the inventory provides accountability and visibility, but a counterfeit unit would simply be recorded and owned like any other, so the control does not prevent the problem. Scheduling secure decommissioning governs how devices are retired and sanitized at end of life, which is important for data protection but happens long after the compromised hardware has been running in production. Monitoring utilization through dashboards tracks performance and capacity; modified firmware is designed to behave normally, so traffic graphs are unlikely to reveal it. Exam caveat: procurement controls are a preventive layer in supply chain risk management, and they are often reinforced with contract terms and right-to-audit clauses for suppliers. Operational check: confirm the purchasing policy restricts network hardware to an approved supplier list, review recent purchase records for exceptions, and verify that received devices were checked against manufacturer authenticity services before installation.