- Third-party-introduced breaches account for a substantial share of total security incidents, making C-SCRM documentation a regulatory, customer, and insurance-underwriting expectation.
- NIST SP 800-161 Rev 1 is the federal standard for C-SCRM and is referenced by DFARS, FAR, FedRAMP, and CMMC. Commercial customers increasingly expect 800-161-aligned documentation.
- Two product options: a streamlined SCRM Plan template for general use, and a NIST 800-161-based C-SCRM Strategy & Implementation Plan (SIP) for federal alignment.
- Both products pair with the Third-Party Risk Management (TPRM) Program for operational documentation.
- C-SCRM is a required component of CMMC Level 2/3 documentation and a common driver of cyber insurance underwriting.
What Is The Purpose Of C-SCRM?
Supply chains are global, meaning it is a worldwide scope that is populated with known bad actors. According to the National Counterintelligence Strategy of the United States (years 2020-2022), the strategic objective for supply chain security is to: “Reduce threats to key U.S. supply chains to prevent foreign attempts to compromise the integrity, trustworthiness, and authenticity of products and services purchased and integrated into the operations of the U.S. Government, the Defense Industrial Base, and the private sector." At the heart of C-SCRM are nation-state "bad actors" and the United States Trade Representative’s Special 301 Report Priority Watch List identifies 10 countries (including China and Russia) on its Priority Watch List, as well as an additional 23 countries on its Watch List. This list of countries sets the stage for identifying potential geography-based threats that can directly or indirectly impact the confidentiality, integrity, availability and safety of an organization's supply chain. Additional scrutiny is required for products and services (1) produced by entities located within those countries or (2) by organizations that have ownership or other Conflict of Interest (COI) concerns with governments listed on those watch lists.
What Are Authoritative Sources For C-SCRM Practices?
There is a lot of invaluable information on the Internet about what C-SCRM is from authoritative sources, such as the US National Institute of Standards and Technology (NIST), the US Department of Homeland Security (DHS), the Cybersecurity & Infrastructure Security Agency (CISA), the US National Counterintelligence and Security Center (NCSC) and many others. It is important to understand that NIST is the authoritative source on C-SCRM-related matters and provides authoritative guidance on the subject for the US Government:
- Section 1323 of the Secure Technology Act tasked NIST with identifying and recommending development of "supply chain risk management standards, guidelines, and practices for executive agencies to use when assessing and developing mitigation strategies to address supply chain risks..."
- Section 201.301(d) of the Federal Acquisition Supply Chain Security Act (FASCSA) requires the Federal Acquisition Security Council (FASC) to consultation with NIST and participate in FASC activities as a member to advise the FASC on NIST standards and guidelines issued under 40 U.S.C. 11331, including ensuring that any recommended orders do not conflict with such standards and guidelines.
NIST has several publications and sites that directly frame or support SCRM:
- NIST SP 800-161, Supply Chain Risk Management Practices for Federal Information Systems and Organizations
- NIST IR 8276, Key Practices in Cyber Supply Chain Risk Management: Observations from Industry
- NIST IR 8286, Integrating Cybersecurity and Enterprise Risk Management (ERM)
- NIST's guidance on Executive Order (EO) 14028
Keep in mind that the NIST publications are merely guidance and there is no formal implementation guidance for C-SCRM.
C-SCRM Planning Focuses On A Resilient vs Reactive Operational Mindset
National Institute of Standards and Technology’s (NIST) SP 800-160, Developing Cyber Resilient Systems: A Systems Security Engineering Approach, is the authoritative source for "cyber resiliency" and secure engineering principles within the realm of cybersecurity and data protection. A common definition of resilience is “the capacity to quickly recover from difficulties.” Resilience is a measure of an organization’s elasticity – being able to spring back into a pre-determined operational state following an event. Organizations should strive to be resilient to IT and cybersecurity-related incidents both internally and across the supply chain. This concept requires automating Continuous Configuration Enforcement (CCE) across all application technology platforms.
NIST’s National Cybersecurity Center of Excellence (NCCoE) has produced several reference materials intended to support ransomware threat mitigation and all guidance starts with the assumption that devices are hardened - that is NIST's baseline starting assumption for organizations to protect against ransomware. Hardening systems and the automation of security validation is not a new concept where NIST SP 800-31, Guide to Malware Incident Prevention and Handling for Desktops and Laptops, states that "Organizations should have vulnerability mitigation capabilities to help prevent malware incidents. Organizations should have documented policy, processes, and procedures to mitigate known vulnerabilities that malware might exploit. Because a vulnerability usually can be mitigated through one or more methods, organizations should use an appropriate combination of techniques, including security automation technologies with security configuration checklists and patch management, and additional host hardening measures so that effective techniques are readily available for various types of vulnerabilities."
Traditional incident response and recovery operations are not designed with resilience in mind. Recovery is absolutely possible and Service Level Agreement (SLAs) help establish acceptable data loss parameters, maximum outages, etc. However, this is more of a way to bracket risk management decisions and while is an efficient manner to justify budgets for Continuity of Operations (COOP)-related technologies and staffing, it is not sustainable. While reactive operations are often viewed as heroic endeavors that “saved the organization from doom,” it does not mean that reactive model is the best methodology or least expensive path to follow. Resiliency is.
Reactive-Focused Security Operations: "Downstream" of Events/Incidents
If you study the graphic below, there are a few key takeaways:
- Effort is on the downstream or “right side” of an incident or event – it is reactive. Baselining and configuration management on the upstream or “left side” of the event is often compliance-focused and are not directly tied to response/recovery operations.
- The traditional, reactive model has minimal focus on baselining and configuration management.
- When an incident occurs, there are structured plans to respond that span from minutes to years in duration:
- Incident Response Plan (IRP)
- Disaster Recovery Plan (DRP)
- Business Continuity Plan (BCP)
- Expense is primarily associated with event detection, response, remediation and recovery operations.
Resiliency-Focused Security Operations: "Upstream" of Events/Incidents
If you study the graphic below, there are a few key takeaways:
- Effort is on the upstream or “left side” of an incident or event is prevention-focused. A decrease in effort on the upstream side of an event, will likely result in a decreased operational impact on the downstream or “right side” of the event occurrence.
- There is significant effort placed on baselining and automating configuration management operations.
- When an incident occurs, the automated remediation actions minimize impact and the necessity to activate IRPs, DRPs and BCPs.
- Expense is primarily associated with tightly-controlled configuration management practices.
C-SCRM Kill Chain - Operational Leadership
The concept of a "kill chain" adopts the premise that it is easier to stop and prevent further damage if insecure practices or malicious activities are discovered earlier, rather than later. The intention of using the Change Kill Chain is:
- Innovation and development.
- Onboarding new technologies/services.Focusing resources and efforts on preventative controls, rather than detective controls.
- Business operations (e.g., manufacturing, service delivery, etc.).
- Business Continuity & Disaster Recovery (BCDR).
- Third-party relationship onboarding and management (e.g., vendors, service providers, contractors, etc.).
- Decommissioning technologies, services and third-party relationships.
Efficient operational leadership requires the organization to structure roles that are complementary and not counterproductive. For the CSCO role to be successful in executing the organization’s SCRM program:
- The CSCO needs to report directly to the organization’s Chief Executive Officer (CEO) to eliminate conflicts of interests among leadership representing Lines of Business (LOB) within the organization.
- The CSCO must be able to influence cybersecurity and data protection controls by being part of the organization’s cybersecurity steering committee.
- Due to the reliance on risk management practices and the underlying cybersecurity and data protection controls that enable a SCRM program to function, the Chief Information Security Officer (CISO) should directly report to the CSCO.
- Due to the external focus of the SCRM program, the Chief Contracting Officer (CCO) role should directly report to the CSCO to ensure contracts and procurement actions are in-line with the SCRM program.
- Due to how technology is so integral to business operations, the Chief Information Officer (CIO) role should directly report to the CSCO.
- The CISCO, CIO, CTO and CCO need to be viewed as peers, each with an equal role of importance in the SCRM program, where the CSCO provides operational leadership to orchestrate SCRM activities across the enterprise and its supply chain.
C-SCRM Kill Chain - Secure Development Practices
C-SCRM is an enterprise-wide activity that is implemented throughout the System Development Life Cycle (SDLC). Within the concept of secure development practices, in order to ensure C-SCRM is operational it takes the following to exist and be functional:
- Maintain close working relationships through frequent visits and communications.
- Mentor and coach suppliers on C-SCRM and actively help suppliers improve their cybersecurity and supply chain practices.
- Business operations (e.g., manufacturing, service delivery, etc.).Invest in common solutions.
- Require the use of the same standards within the acquirer organizations and by suppliers, thereby simplifying communications about cybersecurity risk and mitigations and helping to achieve a uniform level of quality throughout the ecosystem.
Resilience and improvement activities include:
- Rules and protocols for information sharing between acquirers and suppliers.
- Joint development, review and revision of incident response, business continuity and disaster recovery plans.
- Protocols for communicating vulnerabilities and incidents.
- Responsibilities for responding to cybersecurity incidents.
- Coordinated communication methods and protocols.
- Coordinated restoration and recovery procedures.
- Collaborative processes to review lessons learned.
- Updates of coordinated response and recovery plans based on lessons learned.
C-SCRM Kill Chain - Procurement Practices
C-SCRM lies at the intersection of cybersecurity and supply chain risk management. Existing supply chain and cybersecurity practices provide a foundation for building an effective Risk Management Program (RMP). Therefore, within the concept of procurement practices, in order to ensure C-SCRM is operational it takes the following to exist and be functional:
- Increased executive leadership or Board of Directors (BoD) involvement for establishing C-SCRM as a top business priority and to ensure proper oversight.
- Clear governance of C-SCRM activities that includes cross-organizational roles and responsibilities with clear definitions and designation/distribution of these roles among enterprise risk management, supply chain, cybersecurity, product management and product security (if applicable) and other relevant functions appropriate for the organization’s business.
- Leading framework-based policies, standards and procedures that provide guidance to different business units detailing their C-SCRM activities.
- Same policies used internally and with suppliers.
- Integration of cybersecurity considerations into the system and product development life cycle.
- Use of cross-functional teams to address specific, enterprise-wide risks.
- Collaborative processes to review lessons learned.
- Clear definition of roles of individuals responsible for cybersecurity aspects of supplier relationships (which may be different than those responsible for procurement activities with specific suppliers).
- Establishment of Centers of Excellence (CoE) to identify and manage best practices.
- A set of measures of success used to facilitate decision-making, accountability and improvement.
- Approved and banned supplier lists.
- Use of software and hardware component inventory (e.g., bill of materials) for third-party components.
- Prioritization of suppliers based on their criticality.
- Establishment of testing procedures for the most critical components.
- Establishment of a known set of security requirements or controls for all suppliers, especially robust security requirements for critical suppliers to be used in procurement (sometimes known as master specifications).
- Service-Level Agreements (SLA) with suppliers that state the requirements for adhering to the organization’s cybersecurity policy and any controls required of the supplier.
- Establishment of intellectual property rights agreements.
- Shared supplier questionnaires across like organizations, such as within the same critical infrastructure sector.
- Upstream propagation of acquirer’s security requirements within the supply chain to sub-tier suppliers.
- Assurance that suppliers have only the access they need in terms of data, capability, functionality and infrastructure; bounding this access by specific time frames during which suppliers need it.
- Use of escrow services for suppliers with a questionable or risky track record.
- Provision of organization-wide training for all relevant stakeholders within the organization, such as supply chain, legal, product development and procurement; this training may also be extended to key suppliers.
- Identification of alternative sources of critical components to ensure uninterrupted production and delivery of products.
- Secure requirements guiding disposal of hardware that contains regulated data (e.g., CUI, FCI, PII, CHD, PHI, etc.) or otherwise sensitive information (e.g., Intellectual Property (IP)).
- Protocols for securely terminating supplier relationships to ensure that all hardware containing acquirer’s data has been properly disposed of and that the risks of data leakage have been minimized.
C-SCRM Kill Chain - Risk Management Practices
C-SCRM needs to be implemented as part of an organization’s overall Enterprise Risk Management (ERM) activities (e.g., NIST SP 800-39 & NISTIR 8286). These risk management practices involve identifying and assessing applicable risks, determining appropriate response actions and developing a C-SCRM strategy. Within the concept of risk management practices, in order to ensure C-SCRM is operational it takes the following to exist and be functional:
- Activities should involve identifying and assessing applicable risks, as well as determining appropriate response actions.
- Developing a C-SCRM strategy and implementation plan to document selected response actions and monitoring performance against that plan.
- Manage risks. Cyber supply chain risk is associated with a lack of visibility into, understanding of and control over many of the processes and decisions involved in the development and delivery of cyber products and services.
- Manage threats and vulnerabilities. Effectively managing cyber supply chain risks requires a comprehensive view of threats and vulnerabilities.
- Threats can be either “adversarial” (e.g., tampering, counterfeits) or “non-adversarial” (e.g., poor quality, natural disasters).
- Vulnerabilities may be “internal” (e.g., organizational procedures) or “external” (e.g., part of an organization’s supply chain).
C-SCRM Kill Chain - Systems, Applications & Services Management Principles
C-SCRM requires organizations to identify critical systems, applications and services, as well as sensitive data, that are most vulnerable and can cause the largest organizational impact if compromised. Within the concept of systems, applications & services management practices, in order to ensure C-SCRM is operational it takes the following to exist and be functional:
- Developing Data Flow Diagrams (DFDs) that track where regulated data (e.g., CUI, FCI, PII, CHD, PHI, etc.) or “crown jewels” IP is stored, transmitted and processed.
- Identifying suppliers that process regulated data or “crown jewels” IP.
- Developing network diagrams that identify suppliers that have access to the acquirer’s system and network infrastructure.
- Threat modeling to determine whether a supplier can become an attack vector by being compromised and allowing threat actors access to the acquirer’s organization.
- For technology companies, whether a supplier can become an attack vector for the technology company’s products or services delivered to customers.
- Controlling the volume of data a supplier has access to or hosts.
- Monitoring the revenue contribution of suppliers (e.g., criticality).
Can You Honestly Answer How Vendor Cybersecurity Requirements Are Management At Your Organization?
When you "peel back the onion" and prepare for an audit, there is a need to address "the how" for certain topics, such as vendor management. While policies and standards are designed to describe WHY something is required and WHAT needs to be done, many companies fail to create documentation to address HOW the policies and standards are actually implemented.
We did the heavy lifting and created several program-level documents to address this need and the Supply Chain Risk Management (SCRM) is one of those products.
Available C-SCRM Products
Both products cover supply chain risk documentation. The difference is depth. The SCRM Plan Template is streamlined and general. The C-SCRM SIP is comprehensive and federal-aligned.
Comprehensive Coverage
Give us a call or send us an email - we are happy to help you find the right solution for your needs!
There are a lot of choices to pick from when selecting a cybersecurity framework. If you are not sure what works best for you, you can read more here. The most common frameworks are NIST 800-53, ISO 27002, the NIST Cybersecurity Framework and the Secure Controls Framework (SCF). To do NIST CSF, ISO 27002 or NIST SP 800-53 properly, it takes more than just a set of policies and standards. While those are foundational to building a cybersecurity program aligned with that framework, there is a need for program-specific guidance that helps operationalize those policies and standards (e.g., risk management program, third-party management, vulnerability management, etc.). It is important to understand what is required to comply with NIST CSF vs ISO 27002 vs NIST SP 800-53, since there are significantly different levels of expectation.
It is important to understand that picking a cybersecurity framework is more of a business decision and less of a technical decision. Realistically, the process of selecting a cybersecurity framework must be driven by a fundamental understanding of what your organization needs to comply with from a statutory, regulatory and contractual perspective, since that understanding establishes the minimum set of requirements necessary to:
- Not be considered negligent with reasonable expectations for cybersecurity & data protection;
- Comply with applicable laws, regulations and contractual obligations; and
- Implement the proper controls to secure your systems, applications and processes from reasonable threats, based on your specific business case and industry practices.
This understanding makes it easy to determine where on the "framework spectrum" (shown above) you need to focus for selecting a set of cybersecurity principles to follow. This process generally leads to selecting the NIST Cybersecurity Framework, ISO 27002, NIST SP 800-53 or SCF as a starting point.