On May 5, 2020 the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency’s (“CISA”) Information and Communications Technology (“ICT”) Supply Chain Risk Management (“SCRM”) Task Force (the “Task Force”) released a six-step guide for organizations to start implementing organizational SCRM practices to improve their overall security resilience.  The Task Force also released a revised fact sheet to further raise awareness about ICT supply chain risk.

As we discussed in a prior blog post on the Task Force’s efforts, the Task Force was established in 2018 with representatives from 17 different defense and civilian agencies, as well as industry representatives across the information technology and communications sectors.  The Task Force has been focused on assessing and protecting security vulnerabilities in government supply chains.  Since its founding, the Task Force has inventoried existing SCRM efforts across the government and industry, including some of the practices reflected in the guide.

The six step guide (key points from which are described in the table below) captures the basic blocking and tackling that companies should consider when establishing their SCRM processes and procedures.

Companies—especially those that do business with the U.S. Government—should evaluate these steps and the extent to which any actions they have already taken comport with this new guidance.  Of particular importance are Steps 3 and 4, which urge companies to assess and understand their supply chain.  Placing emphasis on these steps could provide organizations with the greatest return on investment.  In particular, organizations should consider additional assessment activities in Step 3, including an assessment of the threats (such as insider threats, economic espionage, data manipulation, foreign control and influence) to critical information and ICT components in their organization and the risk those threats pose to the four areas highlighted by the framework (operations, reputation, bottom line, and organizational resilience).  And, as reflected in Step 4, knowing suppliers and, when possible, the suppliers’ sources, is crucial to mitigating supply chain risks.

Although the Task Force’s suggested actions are not required, a concerted and ongoing effort to adhere to this guidance would likely be viewed favorably by the U.S. Government and signal that a company is taking these issues seriously.  For U.S. Government contractors, adherence to the guidance may be critical as the U.S. Government increasingly is looking to its contractors to act as a first line of defense to mitigate vulnerabilities in the Government’s ICT supply chain.  This is particularly true as new regulations relating to supply chain management are finalized that apply to contractors, and in some cases, to commercial companies.  These requirements include Section 889(a)(1)(B) of the National Defense Authorization Act (“NDAA”) for Fiscal Year 2019 (generally prohibiting the U.S. Government from contracting with any “entity” that “uses” Prohibited Products and Services); Section 1654 and 1655 of the NDAA for Fiscal Year 2019 (generally requiring disclosure to DoD if a company has allowed the source code of products sold or intended to be sold to DoD to be reviewed by certain foreign adversaries of the U.S. Government); and Executive Order 13873 and the Department of Commerce’s proposed rule implementing the order (authorizing the U.S. Government to prohibit, mitigate, or unwind certain commercial transactions dealing in or using any information and communications technology and services, discussed in detail in our prior Client Alert).

Each of these forthcoming requirements could have potentially significant implications for companies that sell or procure ICT products.  Early steps to focus on improving security resiliency in existing supply chains will help in preparation for compliance with these requirements and others from the U.S. Government that will inevitably follow.