Information and Communications Technology Supply Chain Security
Information and communications technology (ICT) is integral for the daily operations and functionality of U.S. critical infrastructure. If vulnerabilities in the ICT supply chain—a complex, globally interconnected ecosystem that encompasses the entire life cycle of ICT hardware, software, and managed services and a wide range of entities including third-party vendors, suppliers, service providers, and contractors—are exploited, the consequences can affect all users of that technology or service.
Compounding the complexity of securing the supply chain is that vulnerabilities may be introduced during any phase of the product life cycle: design, development and production, distribution, acquisition and deployment, maintenance, and disposal. These vulnerabilities can include the incorporation of malicious software, hardware, or counterfeit components, flawed product designs, or poor manufacturing processes and maintenance procedures.
CISA is committed to working with government and industry partners to ensure that supply chain risk management is an integrated component of security and resilience planning for the Nation’s infrastructure.
From cell phone devices to information-sharing software, government and industry purchase ICT products and services and use them to power and enable critical infrastructure systems. However, a supply chain is only as strong as its weakest link. Foreign adversaries, hackers, and criminals seeking to steal, compromise or alter, or destroy sensitive information can target government and industry via the contractors, sub-contractors, and suppliers at all tiers of the ICT supply chain.
CISA works with government and industry partners to ensure that supply chain risk management (SCRM) is an integrated component of security and resilience planning for the nation’s infrastructure.
In December 2018, the Department of Homeland Security established the ICT Supply Chain Risk Management (SCRM) Task Force. Co-chaired by CISA and the Information Technology and Communications Sector Coordinating Councils, the Task Force is a public-private partnership charged to identify and develop consensus risk management strategies to enhance global ICT supply chain security. It serves as the Agency’s center of gravity for supply chain risk management partnership activity.
April 27, 2023: 60-Day Notice and Request for Comments on Secure Software Self-Attestation Common Form: Today, CISA in accordance with Executive Order 14028 and the Office of Management and Budget’s guide in OMB M-22-18, Enhancing the Security of the Software Supply Chain through Secure Software Development Practices, is soliciting public comments on the self-attestation common form to be used by software producers. Comments will be accepted through June 26, 2023.
March 2023: We welcome your feedback! Please share your thoughts about one or more of the ICT SCRM Task Force products through this voluntary, anonymous Product Feedback Survey.
A public-private partnership charged to identify and develop consensus risk management strategies to enhance global ICT supply chain security.
CISA advances the SBOM work by facilitating community engagement, development, and progress, with a focus on scaling and operationalization, as well as tools, new technologies, and new use cases.
These six essential steps will assist your organization in managing supply chain risks and building an effective supply chain risk management practice.
Strengthen efforts to secure the ICT supply chain and protect the vast amount of sensitive information being stored in and communicated through ICT products and services.
To strengthen supply chain resiliency, DHS and Department of Commerce provided the eight recommendations as part of a comprehensive, long-term strategy.