On May 5, 2020 the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency’s (“CISA”) Information and Communications Technology (“ICT”) Supply Chain Risk Management (“SCRM”) Task Force (the “Task Force”) released a six-step guide for organizations to start implementing organizational SCRM practices to improve their overall security resilience.  The Task Force also released a revised fact sheet to further raise awareness about ICT supply chain risk.

As we discussed in a prior blog post on the Task Force’s efforts, the Task Force was established in 2018 with representatives from 17 different defense and civilian agencies, as well as industry representatives across the information technology and communications sectors.  The Task Force has been focused on assessing and protecting security vulnerabilities in government supply chains.  Since its founding, the Task Force has inventoried existing SCRM efforts across the government and industry, including some of the practices reflected in the guide.

The six step guide (key points from which are described in the table below) captures the basic blocking and tackling that companies should consider when establishing their SCRM processes and procedures.

Step:

 

       Notable Actions Relating to Step:
1.  Identify

(Determine who from your organization needs to be involved.)

  • Include subject matter experts in cybersecurity, information technology, product development and security, legal, logistics, physical security, acquisition, marketing, and leadership.
  • Bridge offices to create information sharing, metrics, and program objectives that will ultimately reduce supply chain risks.
  • Include representatives from all levels of the organization, including operators.

 

2.  Manage

(Develop supply chain security policies and procedures.)

 

  • Direct the establishment of an enterprise-wide supply chain risk management program.
  • Establish standard operating procedures on how to conduct supply chain risk management and maintain compliance, to include training.
  • Promote supply chain risk management as a business priority.

 

3.  Assess

(Understand the hardware, software, and services that you procure.)

 

  • Understand the critical information in your organization and where it resides.
  • Determine the different parts of your information and communications technology supply chain.
  • Determine the hardware, software, and managed services most pertinent to your organization.  Track the critical components that your organization procures.

 

4.  Know

(Map your supply chain to better understand what components you procure.)

 

  • Answer the question: From which companies do you procure your assets, hardware, software, and services?
  • Consider asking for information about their supply chain risk management practices.
  • Limit suppliers’ access to only the data they need to conduct business.

 

5.  Verify

(Determine how your organization will assess the security culture of suppliers.)

 

  • Set standards for your vendors in terms of their systems, processes, and extended supplier security requirements.  Establish security requirements (e.g., on-site security).
  • Set service-level agreements requiring suppliers to adhere to security policies.
  • Identify methods for assessing assurance and how they will be measured (e.g., self-attestation, auditing).

 

6.  Evaluate

(Establish systems for checking supply chain practices against guidelines.)

  • Establish security as a primary metric (just like cost, schedule, and performance) for assessing a vendor’s ability to meet contract requirements.
  • Implement the program and monitor suppliers’ and your organization’s adherence to SCRM requirements.
  • Determine the schedule at which systems will be monitored against guidelines.

 

Companies—especially those that do business with the U.S. Government—should evaluate these steps and the extent to which any actions they have already taken comport with this new guidance.  Of particular importance are Steps 3 and 4, which urge companies to assess and understand their supply chain.  Placing emphasis on these steps could provide organizations with the greatest return on investment.  In particular, organizations should consider additional assessment activities in Step 3, including an assessment of the threats (such as insider threats, economic espionage, data manipulation, foreign control and influence) to critical information and ICT components in their organization and the risk those threats pose to the four areas highlighted by the framework (operations, reputation, bottom line, and organizational resilience).  And, as reflected in Step 4, knowing suppliers and, when possible, the suppliers’ sources, is crucial to mitigating supply chain risks.

Although the Task Force’s suggested actions are not required, a concerted and ongoing effort to adhere to this guidance would likely be viewed favorably by the U.S. Government and signal that a company is taking these issues seriously.  For U.S. Government contractors, adherence to the guidance may be critical as the U.S. Government increasingly is looking to its contractors to act as a first line of defense to mitigate vulnerabilities in the Government’s ICT supply chain.  This is particularly true as new regulations relating to supply chain management are finalized that apply to contractors, and in some cases, to commercial companies.  These requirements include Section 889(a)(1)(B) of the National Defense Authorization Act (“NDAA”) for Fiscal Year 2019 (generally prohibiting the U.S. Government from contracting with any “entity” that “uses” Prohibited Products and Services); Section 1654 and 1655 of the NDAA for Fiscal Year 2019 (generally requiring disclosure to DoD if a company has allowed the source code of products sold or intended to be sold to DoD to be reviewed by certain foreign adversaries of the U.S. Government); and Executive Order 13873 and the Department of Commerce’s proposed rule implementing the order (authorizing the U.S. Government to prohibit, mitigate, or unwind certain commercial transactions dealing in or using any information and communications technology and services, discussed in detail in our prior Client Alert).

Each of these forthcoming requirements could have potentially significant implications for companies that sell or procure ICT products.  Early steps to focus on improving security resiliency in existing supply chains will help in preparation for compliance with these requirements and others from the U.S. Government that will inevitably follow.

Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Susan B. Cassidy Susan B. Cassidy

Ms. Cassidy represents clients in the defense, intelligence, and information technologies sectors.  She works with clients to navigate the complex rules and regulations that govern federal procurement and her practice includes both counseling and litigation components.  Ms. Cassidy conducts internal investigations for government…

Ms. Cassidy represents clients in the defense, intelligence, and information technologies sectors.  She works with clients to navigate the complex rules and regulations that govern federal procurement and her practice includes both counseling and litigation components.  Ms. Cassidy conducts internal investigations for government contractors and represents her clients before the Defense Contract Audit Agency (DCAA), Inspectors General (IG), and the Department of Justice with regard to those investigations.  From 2008 to 2012, Ms. Cassidy served as in-house counsel at Northrop Grumman Corporation, one of the world’s largest defense contractors, supporting both defense and intelligence programs. Previously, Ms. Cassidy held an in-house position with Motorola Inc., leading a team of lawyers supporting sales of commercial communications products and services to US government defense and civilian agencies. Prior to going in-house, Ms. Cassidy was a litigation and government contracts partner in an international law firm headquartered in Washington, DC.

Photo of Ryan Burnette Ryan Burnette

Ryan Burnette advises defense and civilian contractors on federal contracting compliance and on civil and internal investigations that stem from these obligations. Ryan has particular experience with clients that hold defense and intelligence community contracts and subcontracts, and has recognized expertise in national…

Ryan Burnette advises defense and civilian contractors on federal contracting compliance and on civil and internal investigations that stem from these obligations. Ryan has particular experience with clients that hold defense and intelligence community contracts and subcontracts, and has recognized expertise in national security related matters, including those matters that relate to federal cybersecurity and federal supply chain security. Ryan also advises on government cost accounting, FAR and DFARS compliance, public policy matters, and agency disputes. He speaks and writes regularly on government contracts and cybersecurity topics, drawing significantly on his prior experience in government to provide insight on the practical implications of regulations.