Supply Chain

Cybersecurity Supply Chain Risk Management (C-SCRM) involves identifying, assessing, and mitigating the risks associated with the distributed and interconnected nature of Information Communications Technology and Operational Technology (ICT/OT) product and service supply chains throughout the entire life cycle of a system (including design, development, distribution, deployment, acquisition, maintenance, and destruction). Examples of risks include insertion of counterfeits, unauthorized production, tampering, theft, insertion of malicious software and hardware, as well as poor manufacturing and development practices in the cybersecurity-related elements of the supply chain (1).

• Cybersecurity Framework (CSF) 2.0 C-SCRM Quick-Start Guide − This guide focuses on two ways the CSF can help organizations: 1. Use the CSF’s GV.SC Category to establish and operate a C-SCRM capability; 2. Define and communicate supplier requirements using the CSF.
  National Institute of Standards and Technology
• NIST C-SCRM Resources – Access NIST’s full portfolio of C-SCRM resources. 
  National Institute of Standards and Technology
• ICT SCRM Small and Medium-Sized Businesses Resource Hub − To help small and medium-sized businesses (SMBs) navigate these challenges, this resource hub provides a centralized location for all the resources developed by the ICT SCRM Task Force. These resources can assist SMBs with their establishment and conduct of supply chain risk management programs and policies.
  Cybersecurity and Infrastructure Security Agency
• CISA's Supply Chain Risk Management Essentials − CISA's Supply Chain Risk Management (SCRM) Essentials is a guide for leaders and staff with actionable steps on how to start implementing organizational SCRM practices to improve their overall security resilience.
  Cybersecurity and Infrastructure Security Agency
   

(1) https://csrc.nist.gov/projects/cyber-supply-chain-risk-management