CISA’s ICT Supply Chain Risk Management Task Force Approves New Working Group for Second Phase

WASHINGTON – The Cybersecurity and Infrastructure Security Agency’s (CISA) Information and Communications Technology (ICT) Supply Chain Risk Management (SCRM) Task Force met today to discuss the next phase of its work.  

At the meeting, the task force approved the creation of a new working group to develop attestation frameworks around various aspects of supply chain risk management best practices.  The goal of the framework is to help organizations address a number of key focus areas, including supplier risk, product lifecycle management, business process controls, physical security, data security, and product cybersecurity.  

“The development of this new working group is timely given the risks we are facing the ICT supply chain and broader critical infrastructure community,” said Bob Kolasky, CISA’s Assistant Director for the National Risk Management Center and Task Force co-chair.  “The goal is to empower stakeholders across the ICT ecosystem to make risk-informed decisions that increase trust across their supply chains.”  

The new working group seeks to complement, not compete with, other supply chain attestation-related activities across the U.S. government. The working group will also be part of a broader task force effort to address concerns and needs of small and medium-sized businesses operating within the ICT supply chain ecosystem. 

“The critical security work of our first-of-its-kind task force continues to build momentum as we enter year two and serves as a model for public private cyber coordination,” said Robert Mayer, Senior Vice President of Cybersecurity at USTelecom and Task Force co-chair. “In year one, we brought together a diverse set of industry and government stakeholders committed to meaningful – and actionable – policy recommendations. In our second year, this partnership is committed to addressing the supply chain risk environment by delving deeper into how organizations can effectively manage risk in the context of an increasingly challenging threat environment.”  

“Securing global ICT supply chains remains an international business imperative for IT sector companies and customers and is essential to security in the United States and worldwide,” said John Miller, Senior Vice President of Policy at the Information Technology Industry Council (ITI) and Task Force co-chair. “The new Task Force working group will focus on developing actionable recommendations that will help private sector entities of all sizes demonstrate the effectiveness and accountability of their supply chain security programs and practices.” 

Since it was established in late 2018, the task force has proved to be crucial for public-private supply chain risk management activity. In September 2019, the task force released an Interim Report highlighting its efforts throughout 2019.  

Three of the working groups from year one – information sharing, threat evaluation, and qualified bidder and qualified manufacturer lists – will continue into year two to focus related study topics. 

To learn more about the ICT Supply Chain Risk Management Task Force, visit https://www.cisa.gov/supply-chain-risk-management.

 ###