Only Lexmark Holds Supply Chain Security Certification

According to Lexmark, it has achieved the ISO 20243 standard, becoming the only printer manufacturer to gain this supply chain security certification.

The ISO 20243 standard is a set of requirements and recommendations for mitigating maliciously tainted and counterfeit products. The standard covers supply chain security from product development to manufacturing and distribution.

“Security of commercial off-the-shelf goods is a growing concern among customers, and Lexmark is proud to have taken steps to ease that concern through supply chain security certification — and to be the first and only printer company to achieve it,” said Allen Waugerman (pictured), Lexmark president and chief executive officer.

“This certification demonstrates Lexmark’s deep commitment to ensuring our products are authentic and exactly as we designed them, further validating that we care deeply about providing high quality, secure products to customers around the world,” Waugerman added.

Lexmark is a privately held American company that manufactures laser printers and imaging products headquartered in Lexington, Kentucky. Since 2016 it has been jointly owned by a consortium of three Chinese companies: Apex Technology, PAG Asia Capital, and Legend Capital. The company was formed on March 27, 1991, following a leveraged buyout of IBM Information Products Corporation. Lexmark became a publicly-traded company on the New York Stock Exchange on November 15, 1995. It was reported in April 2016 that Lexmark would be acquired by Apex Technology and PAG Asia Capital for US$3.6 billion. Lexmark was set to be acquired at $40.50 per share in the transaction. Initial talks for the acquisition were begun at the RemaxWorld Expo in 2015. The deal was closed on November 29, 2016.

SO/IEC 20243-1:2018

ISO/IEC 20243-1:2018 (O-TTPS) is a set of guidelines, requirements, and recommendations that address specific threats to the integrity of hardware and software COTS ICT products throughout the product life cycle. This release of the Standard addresses threats related to maliciously tainted and counterfeit products.

The provider’s product life cycle includes the work it does designing and developing products, as well as the supply chain aspects of that life cycle, collectively extending through the following phases: design, sourcing, build, fulfillment, distribution, sustainment, and disposal. While this Standard cannot fully address threats that originate wholly outside any span of control of the provider ? for example, a counterfeiter producing a fake printed circuit board assembly that has no original linkage to the Original Equipment Manufacturer (OEM) ? the practices detailed in the Standard will provide some level of mitigation. An example of such a practice would be the use of security labeling techniques in legitimate products.