Information and Communications Technology Supply Chain Security
Information and communications technology (ICT) is integral for the daily operations and functionality of U.S. critical infrastructure. If vulnerabilities in the ICT supply chain—a complex, globally interconnected ecosystem that encompasses the entire life cycle of ICT hardware, software, and managed services and a wide range of entities including third-party vendors, suppliers, service providers, and contractors—are exploited, the consequences can affect all users of that technology or service.
Compounding the complexity of securing the supply chain is that vulnerabilities may be introduced during any phase of the product life cycle: design, development and production, distribution, acquisition and deployment, maintenance, and disposal. These vulnerabilities can include the incorporation of malicious software, hardware, or counterfeit components, flawed product designs, or poor manufacturing processes and maintenance procedures.
CISA is committed to working with government and industry partners to ensure that supply chain risk management is an integrated component of security and resilience planning for the Nation’s infrastructure.
From cell phone devices to information-sharing software, government and industry purchase ICT products and services and use them to power and enable critical infrastructure systems. However, a supply chain is only as strong as its weakest link. Foreign adversaries, hackers, and criminals seeking to steal, compromise or alter, or destroy sensitive information can target government and industry via the contractors, sub-contractors, and suppliers at all tiers of the ICT supply chain.
CISA works with government and industry partners to ensure that supply chain risk management (SCRM) is an integrated component of security and resilience planning for the nation’s infrastructure.
In December 2018, the Department of Homeland Security established the ICT Supply Chain Risk Management (SCRM) Task Force. Co-chaired by CISA and the Information Technology and Communications Sector Coordinating Councils, the Task Force is a public-private partnership charged to identify and develop consensus risk management strategies to enhance global ICT supply chain security. It serves as the Agency’s center of gravity for supply chain risk management partnership activity.
February 6, 2024: CISA Announces Two-Year Renewal of the ICT Supply Chain Risk Management Task Force: Today, CISA is pleased to announce the two-year renewal of the ICT SCRM Task Force, through January 2026. The renewal will allow working groups to continue their current work efforts on topics such as Artificial Intelligence, and offers the Task Force an opportunity to identify new potential workstreams. It will also enable the Task Force to continue to explore means for building and strengthening partnerships with stakeholders who can help grow the applicability and utilization of Task Force products, tools, and resources to better manage risks facing the ICT supply chain.
We welcome your feedback! Please share your thoughts about one or more of the ICT SCRM Task Force products through this voluntary, anonymous Product Feedback Survey.
A public-private partnership charged to identify and develop consensus risk management strategies to enhance global ICT supply chain security.
CISA advances the SBOM work by facilitating community engagement, development, and progress, with a focus on scaling and operationalization, as well as tools, new technologies, and new use cases.
These six essential steps will assist your organization in managing supply chain risks and building an effective supply chain risk management practice.
Strengthen efforts to secure the ICT supply chain and protect the vast amount of sensitive information being stored in and communicated through ICT products and services.
To strengthen supply chain resiliency, DHS and Department of Commerce provided the eight recommendations as part of a comprehensive, long-term strategy.