Biblio

Government agencies and the military rely upon many kinds of Commercial Off-the-Shelf (COTS) commodity Information Technology (IT) devices, including mobile phones, printers, computer workstations and many other everyday items. Each of these devices is the final product of long supply chains involving many vendors from many nations providing various components and subcomponents, including considerable amounts of software and firmware. Long supply chains provide adversaries with opportunities to insert hidden malicious functionality into this software and firmware that adversaries can exploit to accomplish harmful objectives, including exfiltration of sensitive data and sabotage of critical operations.

Our economy is increasingly global, complex, and interconnected. It is characterized by rapid advances in information technology. IT products and services need to provide sufficient levels of cybersecurity and resilience. The timely availability of international cybersecurity standards and guidance is a dynamic and critical component for the cybersecurity and resilience of all information and communications systems and supporting infrastructures.

Information and Communications Technology (ICT) supply chain risk management (SCRM) is the process of identifying and mitigating risks in the manufacture and distribution of ICT products and services. While the Information Technology (IT) sector and the Communications sector face different supply chain risks, their mitigation strategies are similar. Both sectors emphasize having an end-to-end Cyber-SCRM program, continuously evaluating risks to vendor networks, and maintaining geographically-diverse and occasionally-redundant supply chains in the event of a manufacturer compromise.