CISA Information and Communications Technology Supply Chain Risk Management Task Force Releases New Guidance on Security Resiliency

By Ryan Burnette & Susan B. Cassidy on May 8, 2020

Posted in Cybersecurity, Government Contracts

On May 5, 2020 the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency’s (“CISA”) Information and Communications Technology (“ICT”) Supply Chain Risk Management (“SCRM”) Task Force (the “Task Force”) released a six-step guide for organizations to start implementing organizational SCRM practices to improve their overall security resilience. The Task Force also released a revised fact sheet to further raise awareness about ICT supply chain risk.

As we discussed in a prior blog post on the Task Force’s efforts, the Task Force was established in 2018 with representatives from 17 different defense and civilian agencies, as well as industry representatives across the information technology and communications sectors. The Task Force has been focused on assessing and protecting security vulnerabilities in government supply chains. Since its founding, the Task Force has inventoried existing SCRM efforts across the government and industry, including some of the practices reflected in the guide.

The six step guide (key points from which are described in the table below) captures the basic blocking and tackling that companies should consider when establishing their SCRM processes and procedures.

*Step:*	*Notable Actions Relating to Step:*
1. Identify (Determine who from your organization needs to be involved.)	Include subject matter experts in cybersecurity, information technology, product development and security, legal, logistics, physical security, acquisition, marketing, and leadership. Bridge offices to create information sharing, metrics, and program objectives that will ultimately reduce supply chain risks. Include representatives from all levels of the organization, including operators.
2. Manage (Develop supply chain security policies and procedures.)	Direct the establishment of an enterprise-wide supply chain risk management program. Establish standard operating procedures on how to conduct supply chain risk management and maintain compliance, to include training. Promote supply chain risk management as a business priority.
3. Assess (Understand the hardware, software, and services that you procure.)	Understand the critical information in your organization and where it resides. Determine the different parts of your information and communications technology supply chain. Determine the hardware, software, and managed services most pertinent to your organization. Track the critical components that your organization procures.
4. Know (Map your supply chain to better understand what components you procure.)	Answer the question: From which companies do you procure your assets, hardware, software, and services? Consider asking for information about their supply chain risk management practices. Limit suppliers’ access to only the data they need to conduct business.
5. Verify (Determine how your organization will assess the security culture of suppliers.)	Set standards for your vendors in terms of their systems, processes, and extended supplier security requirements. Establish security requirements (e.g., on-site security). Set service-level agreements requiring suppliers to adhere to security policies. Identify methods for assessing assurance and how they will be measured (e.g., self-attestation, auditing).
6. Evaluate (Establish systems for checking supply chain practices against guidelines.)	Establish security as a primary metric (just like cost, schedule, and performance) for assessing a vendor’s ability to meet contract requirements. Implement the program and monitor suppliers’ and your organization’s adherence to SCRM requirements. Determine the schedule at which systems will be monitored against guidelines.

Companies—especially those that do business with the U.S. Government—should evaluate these steps and the extent to which any actions they have already taken comport with this new guidance. Of particular importance are Steps 3 and 4, which urge companies to assess and understand their supply chain. Placing emphasis on these steps could provide organizations with the greatest return on investment. In particular, organizations should consider additional assessment activities in Step 3, including an assessment of the threats (such as insider threats, economic espionage, data manipulation, foreign control and influence) to critical information and ICT components in their organization and the risk those threats pose to the four areas highlighted by the framework (operations, reputation, bottom line, and organizational resilience). And, as reflected in Step 4, knowing suppliers and, when possible, the suppliers’ sources, is crucial to mitigating supply chain risks.

Although the Task Force’s suggested actions are not required, a concerted and ongoing effort to adhere to this guidance would likely be viewed favorably by the U.S. Government and signal that a company is taking these issues seriously. For U.S. Government contractors, adherence to the guidance may be critical as the U.S. Government increasingly is looking to its contractors to act as a first line of defense to mitigate vulnerabilities in the Government’s ICT supply chain. This is particularly true as new regulations relating to supply chain management are finalized that apply to contractors, and in some cases, to commercial companies. These requirements include Section 889(a)(1)(B) of the National Defense Authorization Act (“NDAA”) for Fiscal Year 2019 (generally prohibiting the U.S. Government from contracting with any “entity” that “uses” Prohibited Products and Services); Section 1654 and 1655 of the NDAA for Fiscal Year 2019 (generally requiring disclosure to DoD if a company has allowed the source code of products sold or intended to be sold to DoD to be reviewed by certain foreign adversaries of the U.S. Government); and Executive Order 13873 and the Department of Commerce’s proposed rule implementing the order (authorizing the U.S. Government to prohibit, mitigate, or unwind certain commercial transactions dealing in or using any information and communications technology and services, discussed in detail in our prior Client Alert).

Each of these forthcoming requirements could have potentially significant implications for companies that sell or procure ICT products. Early steps to focus on improving security resiliency in existing supply chains will help in preparation for compliance with these requirements and others from the U.S. Government that will inevitably follow.

***

This post appears concurrently on Covington’s Inside Government Contracts blog.