Skip to main content
U.S. flag

An official website of the United States government

Here’s how you know

Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

HTTPS

Secure .gov websites use HTTPS
A lock (LockA locked padlock) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Cybersecurity & Infrastructure Security Agency
America's Cyber Defense Agency

Search

 
 
  • Topics
    Cybersecurity Best Practices
    Cyber Threats and Advisories
    Critical Infrastructure Security and Resilience
    Election Security
    Emergency Communications
    Industrial Control Systems
    Information and Communications Technology Supply Chain Security
    Partnerships and Collaboration
    Physical Security
    Risk Management
    How can we help?
    GovernmentEducational InstitutionsIndustryState, Local, Tribal, and TerritorialIndividuals and FamiliesSmall and Medium BusinessesFind Help Locally
  • Spotlight
  • Resources & Tools
    All Resources & Tools
    Services
    Programs
    Resources
    Training
    Groups
  • News & Events
    News
    Events
    Cybersecurity Alerts & Advisories
    Directives
    Request a CISA Speaker
    Congressional Testimony
  • Careers
    Benefits & Perks
    HireVue Applicant Reasonable Accommodations Process
    Hiring
    Resume & Application Tips
    Students & Recent Graduates
    Veteran and Military Spouses
    Work @ CISA
  • About
    Culture
    Divisions & Offices
    Regions
    Leadership
    Doing Business with CISA
    Contact Us
    Site Links
    Reporting Employee and Contractor Misconduct
    CISA GitHub
Report a Cyber Issue
America's Cyber Defense Agency
Breadcrumb
  1. Home
  2. Topics
Share:
Shipping containers and carriers

Information and Communications Technology Supply Chain Security

A supply chain is only as strong as its weakest link. If vulnerabilities in the ICT supply chain are exploited, the consequences can affect all users of that technology or service.

Topics

  • Cybersecurity Best Practices
  • Cyber Threats and Advisories
  • Critical Infrastructure Security and Resilience
  • Election Security
  • Emergency Communications
  • Industrial Control Systems
  • Information and Communications Technology Supply Chain Security
  • Partnerships and Collaboration
  • Physical Security
  • Risk Management

Overview

Information and communications technology (ICT) is integral for the daily operations and functionality of U.S. critical infrastructure. If vulnerabilities in the ICT supply chain—a complex, globally interconnected ecosystem that encompasses the entire life cycle of ICT hardware, software, and managed services and a wide range of entities including third-party vendors, suppliers, service providers, and contractors—are exploited, the consequences can affect all users of that technology or service.

Compounding the complexity of securing the supply chain is that vulnerabilities may be introduced during any phase of the product life cycle: design, development and production, distribution, acquisition and deployment, maintenance, and disposal. These vulnerabilities can include the incorporation of malicious software, hardware, or counterfeit components, flawed product designs, or poor manufacturing processes and maintenance procedures. 

CISA is committed to working with government and industry partners to ensure that supply chain risk management is an integrated component of security and resilience planning for the Nation’s infrastructure.

CISA’s Role

From cell phone devices to information-sharing software, government and industry purchase ICT products and services and use them to power and enable critical infrastructure systems. However, a supply chain is only as strong as its weakest link. Foreign adversaries, hackers, and criminals seeking to steal, compromise or alter, or destroy sensitive information can target government and industry via the contractors, sub-contractors, and suppliers at all tiers of the ICT supply chain.

CISA works with government and industry partners to ensure that supply chain risk management (SCRM) is an integrated component of security and resilience planning for the nation’s infrastructure.

In December 2018, the Department of Homeland Security established the ICT Supply Chain Risk Management (SCRM) Task Force. Co-chaired by CISA and the Information Technology and Communications Sector Coordinating Councils, the Task Force is a public-private partnership charged to identify and develop consensus risk management strategies to enhance global ICT supply chain security. It serves as the Agency’s center of gravity for supply chain risk management partnership activity.

Featured Content

ICT Supply Chain Risk Management Task Force

A public-private partnership charged to identify and develop consensus risk management strategies to enhance global ICT supply chain security.

Software Bill of Materials (SBOM)

CISA advances the SBOM work by facilitating community engagement, development, and progress, with a focus on scaling and operationalization, as well as tools, new technologies, and new use cases.

ICT Supply Chain Program Basics For Your Company

These six essential steps will assist your organization in managing supply chain risks and building an effective supply chain risk management practice.

Executive Order 13873 on Securing the ICT and Services Supply Chain

Strengthen efforts to secure the ICT supply chain and protect the vast amount of sensitive information being stored in and communicated through ICT products and services.

Executive Order 14017 on Securing America's Supply Chains

To strengthen supply chain resiliency, DHS and Department of Commerce provided the eight recommendations as part of a comprehensive, long-term strategy.

ICT Supply Chain Resource Library

Resources and information on supply chain programs, rulemakings, and other activities from across the federal government. 

Related News

CISA, NSA, and ODNI Release Guidance for Customers on Securing the Software Supply Chain

NOV 17, 2022 | BLOG
This guidance and fact sheet provide recommended practices for software customers to ensure the integrity and security of software during the procuring and deployment phases.

Joint Statement by Secretaries Raimondo and Mayorkas on Assessment of Critical Supply Chains Supporting the ICT Industry

EXTERNAL
Secretary of Commerce Gina Raimondo and Secretary of Homeland Security Alejandro N. Mayorkas released a statement on the completion of a one-year assessment of the critical supply chains supporting the information and communications technology (ICT) industry.
Learn more

ICT Supply Chain Risk Management Task Force Announces new members and Working Group

JAN 11, 2022 | PRESS RELEASE
Government and industry members of the Information and Communications Technology (ICT) Supply Chain Risk Management (SCRM) Task Force gathered today to announce new members and map out the Task Force’s 2022 workplan. 

Sharing Information to Get Ahead of Supply Chain Risks

SEP 21, 2021 | BLOG
Securing the global ICT supply chain requires an ongoing, unified effort between government and industry. The ICT Supply Chain Risk Management Task Force has developed two new resources.

Resources

Discover resources (publications, templates, videos, etc.) related to supply chain security.

View all resources

Securing the Software Supply Chain: Recommended Practices Guide for Customers and accompanying Fact Sheet

PUBLICATION
Best practices for software customers on procuring and deploying secure software, with guidance for the Software Bill of Materials.
View Files

Securing the Software Supply Chain: Recommended Practices for Developers

EXTERNAL
This guide discusses security requirements planning, software architecture from a security perspective, key security features, and overall security of software and the underlying infrastructure.
Securing the Software Supply Chain: Recommended Practices Guide for Developers (defense.gov)

Operationalizing Vendor Supply Chain Risk Management Template for Small and Medium-Sized Businesses and Excel

OCT 26, 2021 | PUBLICATION
This resource gears the applicability of the enterprise Vendor Template to be used specifically by small and medium-sized businesses.
View Files

Securing Small and Medium-Sized Business (SMB) Supply Chains: A Resource Handbook to Reduce Information and Communication Technology Risks

JAN 26, 2023 | PUBLICATION
This handbook provides an overview of the highest supply chain risk categories commonly faced by ICT small and medium-sized businesses (SMBs), including cyber risks, and resources that can assist SMBs.
Download File (PDF, 580.12 KB)
View all resources

Contact Us

For more information regarding supply chain security, contact ict_scrm_taskforce@cisa.dhs.gov.

Return to top
  • Topics
  • Spotlight
  • Resources & Tools
  • News & Events
  • Careers
  • About
Cybersecurity & Infrastructure Security Agency
  • Facebook
  • Twitter
  • LinkedIn
  • YouTube
  • Instagram
  • RSS
CISA Central 888-282-0870 Central@cisa.dhs.gov
DHS Seal
CISA.gov
An official website of the U.S. Department of Homeland Security
  • About CISA
  • Accessibility
  • Budget and Performance
  • DHS.gov
  • FOIA Requests
  • No FEAR Act
  • Office of Inspector General
  • Privacy Policy
  • The White House
  • USA.gov
  • Website Feedback