Information and Communications Technology Supply Chain Security
Information and communications technology (ICT) is integral for the daily operations and functionality of U.S. critical infrastructure. If vulnerabilities in the ICT supply chain—a complex, globally interconnected ecosystem that encompasses the entire life cycle of ICT hardware, software, and managed services and a wide range of entities including third-party vendors, suppliers, service providers, and contractors—are exploited, the consequences can affect all users of that technology or service.
Compounding the complexity of securing the supply chain is that vulnerabilities may be introduced during any phase of the product life cycle: design, development and production, distribution, acquisition and deployment, maintenance, and disposal. These vulnerabilities can include the incorporation of malicious software, hardware, or counterfeit components, flawed product designs, or poor manufacturing processes and maintenance procedures.
CISA is committed to working with government and industry partners to ensure that supply chain risk management is an integrated component of security and resilience planning for the Nation’s infrastructure.
From cell phone devices to information-sharing software, government and industry purchase ICT products and services and use them to power and enable critical infrastructure systems. However, a supply chain is only as strong as its weakest link. Foreign adversaries, hackers, and criminals seeking to steal, compromise or alter, or destroy sensitive information can target government and industry via the contractors, sub-contractors, and suppliers at all tiers of the ICT supply chain.
CISA works with government and industry partners to ensure that supply chain risk management (SCRM) is an integrated component of security and resilience planning for the nation’s infrastructure.
In December 2018, the Department of Homeland Security established the ICT Supply Chain Risk Management (SCRM) Task Force. Co-chaired by CISA and the Information Technology and Communications Sector Coordinating Councils, the Task Force is a public-private partnership charged to identify and develop consensus risk management strategies to enhance global ICT supply chain security. It serves as the Agency’s center of gravity for supply chain risk management partnership activity.
ICT Supply Chain Risk Management Task Force
A public-private partnership charged to identify and develop consensus risk management strategies to enhance global ICT supply chain security.
Software Bill of Materials (SBOM)
CISA advances the SBOM work by facilitating community engagement, development, and progress, with a focus on scaling and operationalization, as well as tools, new technologies, and new use cases.
ICT Supply Chain Program Basics For Your Company
These six essential steps will assist your organization in managing supply chain risks and building an effective supply chain risk management practice.
Executive Order 13873 on Securing the ICT and Services Supply Chain
Strengthen efforts to secure the ICT supply chain and protect the vast amount of sensitive information being stored in and communicated through ICT products and services.
Executive Order 14017 on Securing America's Supply Chains
To strengthen supply chain resiliency, DHS and Department of Commerce provided the eight recommendations as part of a comprehensive, long-term strategy.
ICT Supply Chain Resource Library
Resources and information on supply chain programs, rulemakings, and other activities from across the federal government.
Joint Statement by Secretaries Raimondo and Mayorkas on Assessment of Critical Supply Chains Supporting the ICT Industry
ICT Supply Chain Risk Management Task Force Announces new members and Working Group
Sharing Information to Get Ahead of Supply Chain Risks
Discover resources (publications, templates, videos, etc.) related to supply chain security.
Securing the Software Supply Chain: Recommended Practices Guide for Customers and accompanying Fact Sheet
Securing the Software Supply Chain: Recommended Practices for Developers
Operationalizing Vendor Supply Chain Risk Management Template for Small and Medium-Sized Businesses and Excel
Securing Small and Medium-Sized Business (SMB) Supply Chains: A Resource Handbook to Reduce Information and Communication Technology Risks
For more information regarding supply chain security, contact firstname.lastname@example.org.