supply chain management | The Contracting Education Academy

November 4, 2019 By cs

Is Congress in the dark on supply chain risk?

Top senators on the Senate Homeland Security Committee have warned the Office of Management and Budget that IT professionals in Congress and the federal judiciary may not be getting all the supply chain risk information they need to secure their computer systems and networks as they make acquisitions.

The senators wrote to OMB Director Mick Mulvaney ″urging” the Federal Acquisition Security Council (FASC) to develop a strategic plan for sharing supply chain security information with Congress and the judiciary. The letter is signed by Chairman Ron Johnson, R-Wisc.; Ranking Member Gary Peters, D-Mich.; Sen. Tom Cotton, R-Ark.; and Sen. Ron Wyden, D-Ore.

The FASC is responsible for increasing information sharing within the federal government regarding supply chain risk and creating guidelines and practices for risk management. The FASC distributes the intelligence community’s supply change risk management (SCRM) threat analysis to federal civilian agencies making acquisitions decisions. But the senators said that the information from FASC is not reaching the other two branches of government and supply chain solutions that work for executive agencies don’t necessarily work for the “whole of government.”

Keep reading this article at: https://www.fifthdomain.com/civilian/omb/2019/10/11/is-congress-in-the-dark-on-supply-chain-risk/

September 3, 2019 By cs

How to manage risk along the federal government supply chain

Even the most sophisticated federal agencies have found it difficult to effectively measure and evaluate the cyber risk of their contractor base.

The U.S. federal government relies on an ever-expanding supply chain of tens of thousands of contractors and subcontractors to provide critical services, hold and maintain sensitive data, and perform key functions. While this supply chain is essential to agencies’ fundamental operations, it also increases the number of access point nefarious actors have to their systems and data and, consequently, puts agencies and sensitive data at greater risk.

Even the most sophisticated federal agencies have found it difficult to effectively measure and evaluate the cyber risk of their contractor base. For example, the Navy recently released a report that highlighted growing concerns around supply chain cybersecurity, noting that the federal supply chain has been “compromised in ways and to an extent yet to be fully understood.” In a July 2019 report on the security of its contractors, the Defense Department Inspector General was blunt: The department “does not know the amount of DoD information managed by contractors and cannot determine whether contractors are protecting unclassified DoD information from unauthorized disclosure.”

In fact, data suggests that contractors are not meeting agency expectations for security. Recent BitSight research found that the average security performance rating across all federal agencies was at least 15 points higher than the mean security performance rating of any contractor sector. In other words, there is a significant security performance gap between federal agencies and their supply chain partners.

The time has come for agencies to prioritize this critical risk in their cybersecurity programs. There are steps agencies can take to more effectively measure, monitor and manage this challenge.

Keep reading this article at: https://www.nextgov.com/ideas/2019/08/how-manage-risk-along-federal-government-supply-chain/159401/

November 6, 2018 By AMK

Cyber supply chain task force to meet soon

A task force focused on reducing cybersecurity risks in the nation’s technology and communications supply chain will meet for the first time in the next few weeks, the Homeland Security Department announced last week.

Homeland Security Secretary Kirstjen Nielsen announced the task force’s creation during a cyber conference in New York in July during which she also announced the creation of a new Homeland Security division, the National Cyber Risk Management Center, focused on long-range cyber issues.

The task force will be chaired by private sector leaders but will be sponsored by the risk management center, according to a Homeland Security news release.

The task force will focus on government and industry supply chains and criminal and nation-state hacker efforts to compromise contractors and subcontractors deep within those supply chains, the department said.

Keep reading this article at: https://www.nextgov.com/cybersecurity/2018/10/cyber-supply-chain-task-force-meet-soon/152429/

October 31, 2018 By AMK

DHS to use federal procurement to further reduce risks to the supply chain

The Homeland Security Department’s initiatives over the past year to address supply chain risks aren’t even close to hitting a crescendo. But the pace and volume of the drumbeat is distinctly mounting.

If the efforts to ban Kaspersky Lab, ZTE and Huawei products were just the prelude to the symphony, then the National Risk Management Center’s initial sprint topics, the business due diligence request for information and the latest effort to use the power of federal procurement are the opening sonata.

“There is a growing awareness and understanding to this issue. Our biggest challenge today is not having a national strategy around it while other countries do,” said Jennifer Bisceglie, president and CEO of Interos Solutions, which provides risk assessment services. “Until we have a national strategy, you will have pop up policies or programs or studies, like the one from MITRE. The time is beyond here to have a national strategy.”

The White House’s National Cyber Strategy gave a brief mention to supply chain risk management, saying the government should “improve awareness of supply chain threats and reduce duplicative supply chain activities within the United States government, including by creating a supply chain risk assessment shared service.” But it offered no specific details or initiatives.

Keep reading this article at: https://federalnewsnetwork.com/reporters-notebook-jason-miller/2018/10/dhs-to-use-federal-procurement-to-further-reduce-risks-to-the-supply-chain/

December 12, 2017 By AMK

Changes to supply chain management and commercial item contracting in FY 2018 NDAA

For Department of Defense (DoD) acquisitions, the Conference Report for Fiscal Year 2018 NDAA includes provisions that simplify and others that complicate contractor responsibilities.

On November 8, 2017, the U.S. Senate and House Armed Services Committees announced that they had reached agreement to reconcile the different versions of the National Defense and Authorization Act (NDAA) for Fiscal Year 2018 passed by the Senate and House earlier in the year.

The Senate unanimously approved the compromise legislation on November 16, sending it to President Trump to sign into law. The 2018 National Defense and Authorization Act Conference Report sent to the President includes proposed changes to supply chain management, to the definition of a “subcontractor” and to commercial item contracting that may impact your business.

Keep reading this article at: https://www.lexology.com/library/detail.aspx?g=238f078d-5398-4cba-ba7b-8fdb3e308575

Even the most sophisticated federal agencies have found it difficult to effectively measure and evaluate the cyber risk of their contractor base.

A task force focused on reducing cybersecurity risks in the nation’s technology and communications supply chain will meet for the first time in the next few weeks, the Homeland Security Department announced last week.

The Homeland Security Department’s initiatives over the past year to address supply chain risks aren’t even close to hitting a crescendo. But the pace and volume of the drumbeat is distinctly mounting.

For Department of Defense (DoD) acquisitions, the Conference Report for Fiscal Year 2018 NDAA includes provisions that simplify and others that complicate contractor responsibilities.

Search this Website