ICT Supply Chain Resource Library

This library is a non-exhaustive list of free, voluntary resources and information on supply chain programs, rulemakings, and other activities from across the federal government. The resources provide a better understanding of the wide array of supply chain risk management (SCRM) efforts and activities underway or in place.

Please engage directly with the owner of these programs to better understand the specifics of any of these individual authorities or programs or reach out to update/expand this list.

CISA Resources

CISA Insights: Risk Considerations for Managed Service Provider Customers

  • This resource provides a framework with an actionable checklist for government, organizations, and small and medium-sized businesses that use Managed Service Providers (MSPs) to manage their IT services on how to mitigate against third-party risk and harden their networks to improve overall security and resilience.

ICT Supply Chain Risk Management (SCRM) Essentials

  • A guide for leaders and staff with actionable steps on how to start implementing organizational SCRM practices to improve their overall security resilience.

ICT SCRM Fact Sheet

  • A one-pager on the role of ICT in critical infrastructure operations, risks ICT faces, and overview of the Task Force.

ICT Supply Chain Risks Infographic

  • This infographic provides government and industry leaders at all levels insight into how vulnerabilities can be introduced into the ICT supply chain and the consequences of their exploitation.

Paper on EO 13873 Response: Methodology for Assessing the Most Critical ICT and Services and Frequently Asked Questions: DHS's ICT Methodology in Support of EO 13873

  • In response to Executive Order 13873, CISA's National Risk Management Center and the ICT SCRM Task Force worked with government and industry partners to describe a standardized taxonomy of ICT elements; perform criticality assessments on the ICT elements with appropriate stakeholder input; and assess the national security risks stemming from vulnerabilities in ICT hardware, software, and services, including components enabling 5G communication.

Securing the Software Supply Chain: Recommended Practices Guide for Developers 

  • Supported by CISA, the National Security Agency (NSA), and the Office of the Director for National Intelligence, the Enduring Security Framework Working Group (a cross-sector, public-private working group) developed a three-part series for securing the software supply chain. This first guide addresses high priority cyber-based threats to the nation’s critical infrastructure. It focuses on principals to include security requirements planning, designing software architecture from a security perspective, adding security features, and maintaining the security of software and the underlying infrastructure (e.g., environments, source code review, testing).

Securing the Software Supply Chain: Recommended Practices Guide for Suppliers and accompanying fact sheet 

  • Supported by CISA, the National Security Agency (NSA), and the Office of the Director for National Intelligence, the Enduring Security Framework Working Group (a cross-sector, public-private working group) developed a three-part series for securing the software supply chain. This second guide for suppliers (i.e., vendors) was developed to help organizations define software security checks, protect software, produce well-secured software, and respond to vulnerabilities on a continuous basis.

Securing the Software Supply Chain: Recommended Practices Guide for Customers (and accompanying fact sheet)

  • Supported by CISA, the National Security Agency (NSA), and the Office of the Director of National Intelligence, the Enduring Security Framework Working Group (a cross-sector, public-private working group) developed a three-part series for securing the software supply chain. This final part of the series guides software customers through the procurement, testing, deployment, and patching process; it also includes much needed guidance for software bill of materials (SBOMs).

Other Resources, Programs, and Trainings

5G Market Penetration and Risk Factors Infographic

  • This infographic provides a high-level overview of select mobile network equipment components market leaders, major components of 5G networking, and points of vulnerability in the 5G network.

Cyber Supply Chain Risk Management for the Public

  • This free three-part course introduces what a supply chain is, how adversaries target supply chains, and steps that individuals and organizations can take to improve supply chain security. There are no log-in requirements.

Defending Against Software Supply Chain Attacks

  • This resource, released by CISA and the National Institute of Standards and Technology (NIST), provides an overview of software supply chain risks and recommendations on how software customers and vendors can use the NIST Cyber SCRM (C-SCRM) Framework and the Secure Software Development Framework (SSDF) to identify, assess, and mitigate software supply chain risks. It also provides in-depth recommendations and key steps for prevention, mitigation, and resilience of software supply chain attacks.

Internet of Things (IoT) Acquisition Guidance Document 

  • This document highlights areas of elevated risk resulting from the software-enabled and connected aspects of IoT technologies and their role in the physical world. It provides information on certain vulnerabilities and weaknesses; suggests solutions for common challenges; and identifies factors to consider before purchasing or using IoT devices, systems, and services.

    Industrial Control Systems Joint Working Group

    • This working group facilitates information sharing and the reduction of risk to the Nation’s industrial control systems. It provides a vehicle for communicating and partnering across all critical infrastructure sectors between federal agencies and departments, as well as private asset owners and operators of industrial control systems.

    Overview of Risks Introduced by 5G Adoption in the United States

    • This resource provides an overview of CISA’s preliminary analysis of the vulnerabilities likely to affect the secure adoption and implementation of 5G technologies. Examples of key findings include a potential increase of attack vectors due to the increase of components required to deploy 5G as well as the integration of legacy vulnerabilities from 4G/LTE since 5G will initially be built on 4G infrastructure.

    Videos

    Building Collective Supply Chain Resilience highlights the role and importance of the ICT SCRM Task Force and working together to manage risks to the global ICT supply chain.

    Building Collective Supply Chain Resilience


    Assessing ICT Trustworthiness highlights the importance of securing not only your organization’s immediate supply chain, but also the extended supply chains of your vendors and suppliers.


    Understanding Supply Chain Threats emphasizes the importance of having security measures in place to mitigate against the most common supply chain threats.


    Knowing the Essentials details how organizations and their staff can get started strengthening their SCRM practices and stay vigilant of the evolving threat environment.

    ICT SCRM Task Force Resources

    For resources by the ICT Supply Chain Risk Management Task Force, visit: ICT SCRM Task Force Resources.

    Proposed Rulemakings and Executive Orders

    Executive Order 14017: AMERICA’s Supply Chains

    Executive Order 14028: Improving the Nation's Cybersecurity

    Executive Order 14034: Protecting Americans' Sensitive Data from Foreign Adversaries

    Executive Order Regarding the Acquisition of Musical.ly by ByteDance Ltd

    Executive Order 13920: Securing the United States Bulk-Power System

    Executive Order 13913: Establishing the Committee for the Assessment of Foreign Participation in the United States Telecommunications Services Sector

    Proposed Rule to Implement Regulations Pursuant to Executive Order 13873

    Executive Order 13873: Securing the Information and Communications Technology And Services Supply Chain

    Department of Commerce

    Bureau of Industry and Security

    De minimis Regulation

    • Updates to the Bureau of Industry and Security (BIS) Entity List prohibits the export, reexport, and retransfer of all U.S.-origin items subject to Export Administration Regulations (EAR) to entities on that list. Under the de minimis rule (15 CFR §734.4), foreign-made products that incorporate more than a set percentage of controlled U.S.-origin content by value may be subject to export controls to selected entities.  Additional license requirements will be imposed on items subject to EAR to selected entities on the list. As well, limitations on most license exceptions will be applied to these items. BIS offers the De minimis and Direct Product Rules Decision Tool “to help determine if a non-U.S.-made item located outside the United States is subject to [EAR].” As well, EAR features guidelines for de minimis rules (15 CFR Appendix Supplement No. 2 to Part 734)

    Entity List

    • The BIS Entity List (15 CFR Appendix Supplement No. 4 to Part 744), as defined in 15 CFR §744.16, contains the names of foreign parties subject to specific license requirements for the export, reexport, or in-country transfer of controlled items, ensuring sensitive technologies do not fall into the hands of those who would threaten U.S. national security or American citizens. Organizations or persons who violate these rules—as defined under EAR—are subject to criminal penalties and administrative sanctions. For more information, visit the BIS Entity List webpage.

    Export Administration Regulations: Amendments to General Prohibition Three (Foreign-Produced Direct Product Rule) and the Entity List

    • Effective May 15, 2020, BIS published a rule (85 FR 29849) that “amends General Prohibition Three, also known as the foreign-produced direct product rule, by exercising existing authority under the Export Control Reform Act of 2018, to impose a new control over certain foreign-produced items when there is knowledge that such items are destined to a designated entity on the [BIS] Entity List.

    National Institute of Standards and Technology 

    National Cybersecurity Center of Excellence Supply Chain Assurance Project

    Related Best Practices and Standards

    National Telecommunications and Information Administration

    Communications Supply Chain Risk Information Partnership (C-SCRIP)

    Software Bill of Materials (SBOM) Program

    Department of Energy

    Enterprise Supply Chain Risk Management e(SCRM) Program

    Federal Communications Commission

    Communications Security, Reliability, and Interoperability Council (CSRIC)

    Final Rule: Protecting Against National Security Threats to the Communications Supply Chain Through FCC Programs; Huawei Designation; ZTE Designation

    • On January 3, 2020, the FCC adopted a rule that prospectively prohibits the use of Universal Service Fund (USF) funds to purchase, obtain, maintain, improve, modify, or otherwise support equipment or services produced or provided by a covered company posing a national security threat to the integrity of communications networks or the communications supply chain (85 FR 230, FCC-19-121). This rule relates to sections 2 and 3 of the Secure and Trusted Communications Network Act.

    Process Reform for Executive Branch Review of Certain FCC Applications and Petitions Involving Foreign Ownership Report and Order

    • On September 30, 2020, the FCC adopted a report and order that allows the FCC to adopt rules and procedures that streamline the process by which [the FCC] coordinates with the Executive Branch agencies for assessment of any national security, law enforcement, foreign policy, or trade policy issues regarding certain applications filed with the Commission (IB Docket No. 16-155).

    Protecting Against National Security Threats to the Communications Supply Chain Through FCC Programs – Huawei Designation

    • On June 30, 2020, the FCC issued a final designation order (DA-20-690) in PS Docket No. 19-351 designating “Huawei, as well as its parents, affiliates, and subsidiaries, as a covered company for purposes of 47 CFR § 54.9.” On July 30, 2020, Huawei filed an application for review (Public Notice DA-20-832) of said final designation order in the docket.

    Protecting Against National Security Threats to the Communications Supply Chain Through FCC Programs – ZTE Designation

    • On June 30, 2020, FCC issued a final designation order (DA-20-691) in PS Docket No. 19-352 designating “ZTE, as well as its parents, affiliates, and subsidiaries, as a covered company for purposes of 47 CFR § 54.9.” On July 30, 2020, ZTE filed a petition for reconsideration (Public Notice DA-20-831) of said final designation order in the docket.

    Office of Management and Budget

    Federal Acquisition Security Council

    Supply Chain and 5G-Related Legislation

    National Strategy to Secure 5G of the United States

    Recent legislative efforts relating to 5G technology that could potentially have an impact on ICT supply chains or ICT SCRM Task Force efforts include:

    Other Activities

    Cyberspace Solarium Commission

    Committee on Foreign Investment in the United States (CFIUS)

    Outsourcing of Network Services Assessment Tool (ONSAT)


    For questions, comments, or to provide updates to this library, please email ict_scrm_taskforce@cisa.dhs.gov.

    Was this webpage helpful?  Yes  |  Somewhat  |  No