C-SCRM is the process of identifying, assessing and mitigating risks in an organization's supply chain that could impact the security and integrity of an organization's products, services and operations. C-SCRM includes risks associated with the use of third-party vendors, software and other components that make up an organization's broader technology infrastructure. Effective C-SCRM involves identifying potential vulnerabilities and threats in the supply chain and implementing measures to reduce or eliminate those risks. This includes conducting risk assessments, implementing cybersecurity controls and regularly monitoring the supply chain for evolving threats and potential vulnerabilities. C-SCRM also involves working closely with suppliers and vendors to ensure that those Third-Party Service Providers (TSP) meet an organization's cybersecurity and privacy requirements to prevent the introduction of additional risks to the organization.
ComplianceForge compiled the information on this page to serve as a clearinghouse for SCRM-related material. The issue we are trying to solve is how to operationalize C-SCRM practices, so that organizations have actionable plans that can be implemented to both secure their internal processes and assess/mitigate risks within their supply chain. The goal is for organizations to be both secure and compliant with their C-SCRM obligations.
According to the National Counterintelligence Strategy of the United States (years 2020-2022), the strategic objective for supply chain security is to: “Reduce threats to key U.S. supply chains to prevent foreign attempts to compromise the integrity, trustworthiness, and authenticity of products and services purchased and integrated into the operations of the U.S. Government, the Defense Industrial Base, and the private sector." At the heart of C-SCRM are nation-state "bad actors" and the United States Trade Representative’s Special 301 Report Priority Watch List identifies 10 countries (including China and Russia) on its Priority Watch List, as well as an additional 23 countries on its Watch List. This list of countries sets the stage for identifying potential geography-based threats that can directly or indirectly impact the confidentiality, integrity, availability and safety of an organization's supply chain. Additional scrutiny is required for products and services (1) produced by entities located within those countries or (2) by organizations that have ownership or other Conflict of Interest (COI) concerns with governments listed on those watch lists.
Provenance is the technical means to maintain evidence-based integrity of products and services across an asset's lifecycle. It is the chronology of the origin, development, ownership, location, and changes to a system or system component and associated data. It may also include personnel and processes used to interact with or make modifications to the system, component, or associated data. Provenance helps eliminate false assumptions by governing the integrity of the asset across its lifecycle.
Currently, the are no clear US laws or regulations that mandate suppliers provide multi-tier transparency of supply chains. The closest requirements are narrowly-focused on Controlled Unclassified Information (CUI) as part of several Defense Federal Acquisition Regulation Supplement (DFARS) clauses and Federal Acquisition Regulation (FAR) 52.204-21(2).
C-SCRM is the process of identifying, assessing, and mitigating the risks to the integrity, trustworthiness, and authenticity of products and services within the supply chain. This is often directed at Information and Communications Technology (ICT) that scopes:
A properly scoped C-SCRM program assesses (1) internal risks that are native to every organization and (2) external risks that stem from the third-parties that produce products and/or provide services that make up the acquiring organization's supply chain.
For example, an Internet enabled "smart meter" has more than just software that can be configured, but firmware and hardware that includes microprocessors. Therefore, assessing the supply chain risks associated with smart meters is more than evaluating the functionality and features of the end-product, but the components that come together to make up the end-product.
A successful C-SCRM program is the embodiment of Zero Trust Architecture (ZTA), where there is no such thing as a "trusted third party" since trust is a luxury that C-SCRM cannot afford. ZTA's goal is to minimize the negative impact of any product or service from being used in a malicious manner. While, C-SCRM relies on ZTA principles to architect, build and maintain secure systems, applications, services and networks, SCRM also relies on the concept of "provenance" where every system and system component has a point of origin and may be changed throughout its existence.
National Institute of Standards and Technology’s (NIST) SP 800-160, Developing Cyber Resilient Systems: A Systems Security Engineering Approach, is the authoritative source for "cyber resiliency" and secure engineering principles within the realm of cybersecurity and data protection. A common definition of resilience is “the capacity to quickly recover from difficulties.” Resilience is a measure of an organization’s elasticity – being able to spring back into a pre-determined operational state following an event. Organizations should strive to be resilient to IT and cybersecurity-related incidents both internally and across the supply chain. This concept requires automating Continuous Configuration Enforcement (CCE) across all application technology platforms.
NIST’s National Cybersecurity Center of Excellence (NCCoE) has produced several reference materials intended to support ransomware threat mitigation and all guidance starts with the assumption that devices are hardened - that is NIST's baseline starting assumption for organizations to protect against ransomware. Hardening systems and the automation of security validation is not a new concept where NIST SP 800-31, Guide to Malware Incident Prevention and Handling for Desktops and Laptops, states that "Organizations should have vulnerability mitigation capabilities to help prevent malware incidents. Organizations should have documented policy, processes, and procedures to mitigate known vulnerabilities that malware might exploit. Because a vulnerability usually can be mitigated through one or more methods, organizations should use an appropriate combination of techniques, including security automation technologies with security configuration checklists and patch management, and additional host hardening measures so that effective techniques are readily available for various types of vulnerabilities."
Traditional incident response and recovery operations are not designed with resilience in mind. Recovery is absolutely possible and Service Level Agreement (SLAs) help establish acceptable data loss parameters, maximum outages, etc. However, this is more of a way to bracket risk management decisions and while is an efficient manner to justify budgets for Continuity of Operations (COOP)-related technologies and staffing, it is not sustainable. While reactive operations are often viewed as heroic endeavors that “saved the organization from doom,” it does not mean that reactive model is the best methodology or least expensive path to follow. Resiliency is.
If you study the graphic below, there are a few key takeaways:
When an incident occurs, there are structured plans to respond that span from minutes to years in duration:
If you study the graphic below, there are a few key takeaways:
There is a lot of invaluable information on the Internet about what C-SCRM is from authoritative sources, such as the US National Institute of Standards and Technology (NIST), the US Department of Homeland Security (DHS), the Cybersecurity & Infrastructure Security Agency (CISA), the US National Counterintelligence and Security Center (NCSC) and many others. It is important to understand that NIST is the authoritative source on C-SCRM-related matters and provides authoritative guidance on the subject for the US Government:
NIST has several publications and sites that directly frame or support SCRM:
Keep in mind that the NIST publications are merely guidance and there is no formal implementation guidance for C-SCRM.
When you read through NIST SP 800-161, you will see that it leverages the concept for a multi-tiered risk model from NIST SP 800-37 to organize risk into three distinct tiers:
When you look at it in a slightly different layout, you can see how that can start applying to a business when you overlay the realities of what needs to be managed:
The concept of the Change Kill Chain model was to create a proof of concept for an efficient way to plan out a roadmap to successfully implement robust Zero Trust and Cybersecurity Supply Chain Risk Management (ZT/C-SCRM) cybersecurity and privacy practices that focus on prevention and automated remediation. The Change Kill Chain model highlights the nature of preventative security controls as an efficient way to protect an organization from the expense and operational disruptions associated with incident response and business continuity activities. The end result is a viable approach for organizations to use in order to create a prioritized project plan for ZT/C-SCRM practices that avoids a myopic, point solution focus by adopting secure practices that are applicable across the supply chain.
"Zero Trust Architecture (ZTA) is more than just by tying logical access to a user’s identity and should take into account the validated integrity of systems, applications and services across the supply chain."
Prevention, tied with automated, reactive technologies can minimize operational disruptions from either hostile or accidental incidents.
The Change Kill Chain breaks the concept of ZT/C-SCRM down into 24 major steps, which can then be translated into a project plan. This project was approached from the question of, “If a consultant was hired to build a ZT/C-SCRM program, what would the plan be to start from nothing to get a company to where it has operational ZT/C-SCRM capabilities?” While the Change Kill Chain maps controls from NIST SP 800-161 to the steps in the model, it is important to emphasize that the prioritization and “bucketing” of controls into phases is a subjective endeavor and not everyone may agree with this approach. If you choose to use the Change Kill Chain, you will invariably need to modify the approach to fit your organization's unique business practices and specific needs.
[click on image to download PDF]
C-SCRM Implementation Plan
The Change Kill Chain is made up of 24 phases (these correspond to those shown in the associated infographic). It is important to note that these steps can be applied both to internal practices and Third-Party Service Providers (TSP). Realistically, an organization must first “master the fundamentals” and have its own ZT/C-SCRM practices in order before proactive oversight of TSPs is feasible.
The Change Kill Chain is based on the principles of the Integrated Controls Management (ICM) model:
Integrated Controls Management Model
To build and maintain efficient and effective operations, a ZT/C-SCRM program must have a hierarchical vision, mission and strategy that directly supports the organization’s broader strategic objectives and business processes. This process of establishing context involves identifying all applicable external compliance requirements (e.g., laws, regulations and contractual obligations), as well as internal directives (e.g., Board of Directors (BoD), corporate policies, etc.). This is a due diligence element of the ZT/C-SCRM program.
This step has 5 subcomponent steps:
A tailored control set of cybersecurity and data protection controls must exist. This control set needs to be made of Minimum Compliance Criteria (MCC) and Discretionary Security Requirements (DSR). This blend of “must have” and “nice to have” requirements establish an organization’s tailored control set to ensure both secure practices and compliance are designed for.
This step has 3 subcomponent steps:
The cybersecurity & privacy program must assign maturity targets to define organization-specific “what right looks like” for controls. This establishes attainable criteria for People, Processes, Technology, Data & Facilities (PPTDF) requirements. Tailored maturity level criteria can be used to plan for, budget for and assess against. Maturity targets should support the organization’s need for operational resiliency.
This step has 4 subcomponent steps:
Documentation must exist, otherwise an organization’s cybersecurity and data protection practices are unenforceable. Formalizing organization-specific requirements via policies and standards are necessary to operationalize controls. Documented policies and standards provide evidence of due diligence that the organization identified and implemented reasonable steps to address its applicable requirements.
This step has 2 subcomponent steps:
Controls must be assigned to stakeholders to ensure accountability (e.g., business units, teams and/or individuals). These “control owners” may assign the task of executing controls to “control operators” at the Individual Contributors (IC)-level. Stakeholders utilize the prescriptive requirements from policies and standards to develop Standardized Operating Procedures (SOP) that enable ICs to execute those controls. The documented execution of procedures provides evidence of due care that reasonable practices are being performed.
This step has 5 subcomponent steps:
Situational awareness must involve more than merely “monitoring controls” (e.g., metrics). While metrics are a point-in-time snapshot into discrete controls’ performance, the broader view of metrics leads to a longer-term trend analysis. When properly tied in with current risk, threat and vulnerability information, this insight provides “situational awareness” that is necessary for organizational leadership to adjust plans to operate within the organization’s risk threshold.
An organization’s Internal Audit (IA) function provides quality control. This function can help validate the scope and impact of risk, which stakeholders may be unaware of. IA practices generate evidence of due care that reasonable steps are in place to validate stakeholder claims and assumptions.
This step has 10 subcomponent steps:
Proactive risk management processes must exist across all phases of development/information/system life cycles to address confidentiality, integrity, availability and safety aspects. Risk management must address internal and external factors, including cybersecurity, privacy and ZT/C-SCRM considerations. To manage risk, it requires the organization to enforce a clearly defined risk threshold and ensure reasonably-expected secure practices are operational.
This step has 3 subcomponent steps:
Develop & implement change control processes and workflows, including a Change Control Board (CCB) that is technically competent to evaluate security ramifications for baseline security configuration deviations.
Develop and implement a centralized Configuration Management Plan (CMP) to enforce secure configurations.
Identify, build & implement secure baseline configurations (e.g., hardening standards) for all technology platforms.
Develop & implement incident response capabilities to detect, respond to and recover from incidents.
Develop & implement physical security capabilities to detect, respond to and recover from physical security incidents.
Develop & implement continuous monitoring capabilities through log collection and analysis (e.g., SIEM).
Develop & implement Identity & Access Management (IAM) to address "least privilege" and Role-Based Access Control (RBAC).
Develop & implement network security practices.
Develop & implement proactive maintenance practices.
Develop & implement Attack Surface Management (ASM) practices as part of a broader Vulnerability & Patch Management Program (VPMP).
Develop & implement a threat intelligence capability.
Develop & implement business continuity capabilities (e.g., Disaster Recovery (DR), Business Continuity (BC), Continuity of Operations (COOP), etc.).
Build and maintain a security-minded workforce through training & awareness.
Develop & implement tamper resistance and detection capabilities.
Develop & implement an Information Assurance Program (IAP) to validate control implementation.
Develop & implement system application and service decommissioning and migration capabilities.
Implement and monitor supply chain protections (contractual obligations, assessments & monitoring compliance).
ComplianceForge developed an editable template for a C-SCRM strategy and implementation plan that is based on NIST SP 800-161 Rev 1, which is the current "gold standard" for authoritative C-SCRM guidance. This is fully-editable documentation (e.g., Word, Excel, PowerPoint, etc.) that can enable your organization to "hit the ground running" with C-SCRM operations.
NIST SP 800-161 Rev 1 - Cybersecurity Supply Chain Risk Management Strategy & Implementation Plan (C-SCRM SIP) product highlights of the C-SCRM SIP include:
To properly manage supply chain-related threats, organizations must evaluate country-based threats posed by its supply chain. This review must cover the geographic concerns where your products, services and support originate from or transit through:
Geographic-specific threat management criteria is refined by guidance from authoritative sources, such as:
An organization's executive leadership team drives the success of C-SCRM. On a day-to-day basis, cybersecurity merely has a supporting role, where an organization's non-technology leadership team is the leading factor in the success of a SCRM program. When you start looking at how do you "do C-SCRM" in a practical manner, it is more than just a control set, where a C-SCRM program needs to have authority over several key business functions that impact supply chain security:
For C-SCRM to be successful, operational leadership is essential. This “active participation” by a Chief Supply Chain Officer (CSCO), and his/her staff, ensures that processes are effectively carried out on a day-to-day basis. In many industries, the CSCO is often designated as the Chief Operations Officer (COO). Regardless of the official title, the CSCO is responsible for internal and external supply chain processes. This scope ranges beyond simple logistics and manufacturing activities to include:
Efficient operational leadership requires the organization to structure roles that are complementary and not counterproductive. For the CSCO role to be successful in executing the organization’s SCRM program:
Hierarchical SCRM Management Structure [proposed organization chart]
C-SCRM is an enterprise-wide activity that is implemented throughout the System Development Life Cycle (SDLC). Within the concept of secure development practices, in order to ensure C-SCRM is operational it takes the following to exist and be functional:
Resilience and improvement activities include:
C-SCRM lies at the intersection of cybersecurity and supply chain risk management. Existing supply chain and cybersecurity practices provide a foundation for building an effective Risk Management Program (RMP). Therefore, within the concept of procurement practices, in order to ensure C-SCRM is operational it takes the following to exist and be functional:
C-SCRM needs to be implemented as part of an organization’s overall Enterprise Risk Management (ERM) activities (e.g., NIST SP 800-39 & NISTIR 8286). These risk management practices involve identifying and assessing applicable risks, determining appropriate response actions and developing a C-SCRM strategy. Within the concept of risk management practices, in order to ensure C-SCRM is operational it takes the following to exist and be functional:
C-SCRM requires organizations to identify critical systems, applications and services, as well as sensitive data, that are most vulnerable and can cause the largest organizational impact if compromised. Within the concept of systems, applications & services management practices, in order to ensure C-SCRM is operational it takes the following to exist and be functional:
C-SCRM for Information Communications Technology (ICT) began in earnest in 2008. The US Government realized that for its own C-SCRM approach to be effective, it would require a strong public-private partnership. Currently, the US National Institute of Standards and Technology (NIST) is the authoritative source on C-SCRM-related matters and provides authoritative guidance on the subject for the US Government:
The NIST Cyber Supply Chain Risk Management (C-SCRM) program started in 2008, when it initiated the development of C-SCRM practices for non-national security systems, in response to Comprehensive National Cybersecurity Initiative (CNCI) #11, "Develop a multi-pronged approach for global supply chain risk management." Since then, NIST has worked with diverse stakeholders from across government, industry and academia to identify and evaluate effective technologies, tools, techniques, practices and standards useful in securing the cyber supply chain. NIST has and continues to research the state of C-SCRM in both the public and private sectors, related standards and initiatives, effective practices and metrics. In addition, NIST has given several grants to conduct research in this area as well as to develop a web-based risk assessment and collaboration tool.
NIST's approach to C-SCRM encompasses the following key points:
The United States Department of Homeland Security (DHS) had plans to publish a final rule on safeguarding Controlled Unclassified Information (CUI) in September 2022. Under development since 2017, this proposed rule is meant to modify Homeland Security Acquisition Regulation (HSAR) to compel DHS contractors to implement security and privacy measures to ensure CUI, such as Personally Identifiable Information (PII), is adequately safeguarded. Specifically, the proposed rule is intended to:
In 2015, DHS incorporated "cyber hygiene" clauses into its contracts and agreements to require DHS contractor compliance with certain cyber standards and protections. DHS began a pathfinder effort in the summer of 2021 to advance a process for assessing industry compliance with cyber hygiene clause requirements. DHS is supposed to identify lessons learned and best practices coming out of early pathfinder work that illustrated the potential adverse impacts to the diverse small industry base supporting many DHS missions. DHS's end goal is to have a means of ensuring a contractor has key cybersecurity and cyber hygiene practices in place as a condition for contract award.
As part of DHS' guidance on cyber hygiene practices on SAM.gov, DHS states the direction points to C-SCRM where its processes are designed to "establish a statistically viable assessment of overall cyber hygiene risk across DHS that will guide continued work towards an improved cyber posture and will aid in establishing the focus of future program development, including government-led assessments. This process is again a critical step in our progress towards maturing our Cyber-Supply Chain Risk Management (C-SCRM) program and protecting the Homeland."
Secure Controls Framework (SCF)
Secure Controls Framework (SCF) "Premium Content" - Expertise-Class Policies, Control Objectives, Standards, Guidelines, Controls & Metrics. Product Walkthrough Video This short product walkthrough video is designed to give a brief overview about...
Sooner, rather than later, the US Government's global supply chain will have to transition to NIST 8...
The CMMC 2.0 & NIST 800-171 R2 version of the CMMC Kill Chain introduces the theory of constrain...
It is worthwhile to take a look at NIST 800-171 R3 through a People, Process, Technology, Data &...
NIST 800-171 Rev 3 was released on 14 May of this year, and it contains significant changes from the...
