The organization defines the personnel or roles to whom counterfeit information system components are to be reported.
No STIG checks reference this CCI.