On May 5, 2020 the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency’s (“CISA”) Information and Communications Technology (“ICT”) Supply Chain Risk Management (“SCRM”) Task Force (the “Task Force”) released a six-step guide for organizations to start implementing organizational SCRM practices to improve their overall security resilience.  The Task Force also released a revised fact sheet to further raise awareness about ICT supply chain risk.

As we discussed in a prior blog post on the Task Force’s efforts, the Task Force was established in 2018 with representatives from 17 different defense and civilian agencies, as well as industry representatives across the information technology and communications sectors.  The Task Force has been focused on assessing and protecting security vulnerabilities in government supply chains.  Since its founding, the Task Force has inventoried existing SCRM efforts across the government and industry, including some of the practices reflected in the guide.

The six step guide (key points from which are described in the table below) captures the basic blocking and tackling that companies should consider when establishing their SCRM processes and procedures.

Step:

 

       Notable Actions Relating to Step:
1.  Identify

(Determine who from your organization needs to be involved.)

  • Include subject matter experts in cybersecurity, information technology, product development and security, legal, logistics, physical security, acquisition, marketing, and leadership.
  • Bridge offices to create information sharing, metrics, and program objectives that will ultimately reduce supply chain risks.
  • Include representatives from all levels of the organization, including operators.

 

2.  Manage

(Develop supply chain security policies and procedures.)

 

  • Direct the establishment of an enterprise-wide supply chain risk management program.
  • Establish standard operating procedures on how to conduct supply chain risk management and maintain compliance, to include training.
  • Promote supply chain risk management as a business priority.

 

3.  Assess

(Understand the hardware, software, and services that you procure.)

 

  • Understand the critical information in your organization and where it resides.
  • Determine the different parts of your information and communications technology supply chain.
  • Determine the hardware, software, and managed services most pertinent to your organization.  Track the critical components that your organization procures.

 

4.  Know

(Map your supply chain to better understand what components you procure.)

 

  • Answer the question: From which companies do you procure your assets, hardware, software, and services?
  • Consider asking for information about their supply chain risk management practices.
  • Limit suppliers’ access to only the data they need to conduct business.

 

5.  Verify

(Determine how your organization will assess the security culture of suppliers.)

 

  • Set standards for your vendors in terms of their systems, processes, and extended supplier security requirements.  Establish security requirements (e.g., on-site security).
  • Set service-level agreements requiring suppliers to adhere to security policies.
  • Identify methods for assessing assurance and how they will be measured (e.g., self-attestation, auditing).

 

6.  Evaluate

(Establish systems for checking supply chain practices against guidelines.)

  • Establish security as a primary metric (just like cost, schedule, and performance) for assessing a vendor’s ability to meet contract requirements.
  • Implement the program and monitor suppliers’ and your organization’s adherence to SCRM requirements.
  • Determine the schedule at which systems will be monitored against guidelines.

 

Companies—especially those that do business with the U.S. Government—should evaluate these steps and the extent to which any actions they have already taken comport with this new guidance.  Of particular importance are Steps 3 and 4, which urge companies to assess and understand their supply chain.  Placing emphasis on these steps could provide organizations with the greatest return on investment.  In particular, organizations should consider additional assessment activities in Step 3, including an assessment of the threats (such as insider threats, economic espionage, data manipulation, foreign control and influence) to critical information and ICT components in their organization and the risk those threats pose to the four areas highlighted by the framework (operations, reputation, bottom line, and organizational resilience).  And, as reflected in Step 4, knowing suppliers and, when possible, the suppliers’ sources, is crucial to mitigating supply chain risks.

Although the Task Force’s suggested actions are not required, a concerted and ongoing effort to adhere to this guidance would likely be viewed favorably by the U.S. Government and signal that a company is taking these issues seriously.  For U.S. Government contractors, adherence to the guidance may be critical as the U.S. Government increasingly is looking to its contractors to act as a first line of defense to mitigate vulnerabilities in the Government’s ICT supply chain.  This is particularly true as new regulations relating to supply chain management are finalized that apply to contractors, and in some cases, to commercial companies.  These requirements include Section 889(a)(1)(B) of the National Defense Authorization Act (“NDAA”) for Fiscal Year 2019 (generally prohibiting the U.S. Government from contracting with any “entity” that “uses” Prohibited Products and Services); Section 1654 and 1655 of the NDAA for Fiscal Year 2019 (generally requiring disclosure to DoD if a company has allowed the source code of products sold or intended to be sold to DoD to be reviewed by certain foreign adversaries of the U.S. Government); and Executive Order 13873 and the Department of Commerce’s proposed rule implementing the order (authorizing the U.S. Government to prohibit, mitigate, or unwind certain commercial transactions dealing in or using any information and communications technology and services, discussed in detail in our prior Client Alert).

Each of these forthcoming requirements could have potentially significant implications for companies that sell or procure ICT products.  Early steps to focus on improving security resiliency in existing supply chains will help in preparation for compliance with these requirements and others from the U.S. Government that will inevitably follow.

Print:
EmailTweetLikeLinkedIn
Susan B. Cassidy

Ms. Cassidy represents clients in the defense, intelligence, and information technologies sectors.  She works with clients to navigate the complex rules and regulations that govern federal procurement and her practice includes both counseling and litigation components.  Ms. Cassidy conducts internal investigations for government…

Ms. Cassidy represents clients in the defense, intelligence, and information technologies sectors.  She works with clients to navigate the complex rules and regulations that govern federal procurement and her practice includes both counseling and litigation components.  Ms. Cassidy conducts internal investigations for government contractors and represents her clients before the Defense Contract Audit Agency (DCAA), Inspectors General (IG), and the Department of Justice with regard to those investigations.  From 2008 to 2012, Ms. Cassidy served as in-house counsel at Northrop Grumman Corporation, one of the world’s largest defense contractors, supporting both defense and intelligence programs. Previously, Ms. Cassidy held an in-house position with Motorola Inc., leading a team of lawyers supporting sales of commercial communications products and services to US government defense and civilian agencies. Prior to going in-house, Ms. Cassidy was a litigation and government contracts partner in an international law firm headquartered in Washington, DC.

Photo of Trisha Anderson Trisha Anderson

Trisha Anderson, an experienced national security and cybersecurity lawyer, advises clients on white collar investigations and national security issues, including national security surveillance and law enforcement compliance and litigation, cybersecurity and data privacy, and CFIUS, with a particular focus on information and communications…

Trisha Anderson, an experienced national security and cybersecurity lawyer, advises clients on white collar investigations and national security issues, including national security surveillance and law enforcement compliance and litigation, cybersecurity and data privacy, and CFIUS, with a particular focus on information and communications technologies.

Ms. Anderson rejoined the firm after over a decade of service in the federal government. She held senior positions at the Department of Justice and the Department of the Treasury. Most recently she served as Principal Deputy General Counsel at the Federal Bureau of Investigation, where she handled complex and sensitive matters relating to national security and cyber intrusions.

Photo of Ryan Burnette Ryan Burnette

Ryan Burnette advises clients on a range of issues related to government contracting. Mr. Burnette has particular experience with helping companies navigate mergers and acquisitions, FAR and DFARS compliance issues, public policy matters, government investigations, and issues involving government cost accounting and the…

Ryan Burnette advises clients on a range of issues related to government contracting. Mr. Burnette has particular experience with helping companies navigate mergers and acquisitions, FAR and DFARS compliance issues, public policy matters, government investigations, and issues involving government cost accounting and the Cost Accounting Standards.  Prior to joining Covington, Mr. Burnette served in the Office of Federal Procurement Policy in the Executive Office of the President, where he worked on government-wide contracting regulations and administrative actions affecting more than $400 billion dollars’ worth of goods and services each year.