6 - Supply Chain Security

Cyber Compliance & Beyond

Supply chain security is not new, though it certainly feels as though it is. Thanks to globalization, supply chains are ever growing in their depth, complexity, and interconnectedness. Unfortunately, like so many other systems, security of supply chains hasn’t been at the top of the list of things to consider when evaluating supply chains. Understandably, economics led the way. A supply chain exists to foster economic growth and profit-making. None of these are bad but there’s a painful irony: the less security is considered, the greater the costs, which drives down growth and profit-making. Costs aren’t just financial, either. The cost of losing a competitive edge is significant but almost impossible to quantify in dollars. It runs much deeper. As data theft has proliferated on an unprecedented scale, the need for securing supply chains has begun it’s rise to the top of our consciousness. The intriguing thing about supply chain security is that it isn’t all that different than traditional risk management activities.

Today’s guest is John Santore, Director of Cybersecurity Services here at Kratos. Together, we’ll dive into supply chain security. We’ll outline what a supply chain is, what to consider when evaluating your supply chain, some of the challenges you might encounter along the way and we’ll outline a basic supply chain risk management approach.

Resources:

The core tenants of a supply chain risk management approach:

• Inventory your supply chain
• Ensure strong relationships are in place with those in your supply chain
• Develop criteria for evaluating the risk of suppliers within your organization
• Work with your suppliers to obtain the information necessary to perform the evaluation
• Develop a process for scrutinizing suppliers that are identified as high-risk
• Repeat the process on a defined frequency
• Ensure that it is applied as part of any supplier intake

Links:

• NIST SP 800-161: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations
• C-SCRM Factsheet
• NIST SP 800-218: Secure Software Development Framework
• Executive Order 14028
• OMB M-22-18
• OMB M-23-16