Before the 

U.S. DEPARTMENT OF COMMERCE 

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY 

Gaithersburg, MD, 20899 

In the Matter of ) 

) 

Evaluating and Improving NIST Cybersecurity ) 

Resources: The Cybersecurity Framework and ) Docket No. 220210-0045 

Cybersecurity Supply Chain Risk Management ) 

COMMENTS OF THE 

TELECOMMUNICATIONS INDUSTRY ASSOCIATION 

The Telecommunications Industry Association (“TIA”) appreciates the opportunity to 

provide additional input to the National Institute of Standards and Technology (“NIST”) in 

response to the NIST Cybersecurity Framework 2.0 Concept Paper. TIA recognizes the 

importance of NIST’s Cybersecurity Framework (“Framework” or “CSF”), which provides an 

invaluable tool for Information and Communications Technology (“ICT”) industry efforts to 

build security into their networks and supply chains. 

As we mentioned in our comments in response to NIST’s Request for Information on 

Evaluating and Improving NIST Cybersecurity Resources: The Cybersecurity Framework and 

Cybersecurity Supply Chain Risk Management (“RFI”), security is at the core of what we do at 

TIA. 

1

 TIA represents more than four hundred domestic and global manufacturers and vendors of 

telecommunications equipment and services – Our members compose the trusted manufacturers 

and vendors of the ICT industry. TIA is also an ANSI-accredited Standards Development 

Organization, and we have launched the first standard to drill down and add transparency and 

trust to the ICT supply chain – SCS 9001. 

1

 TIA Comments on NIST RFI (April 25, 2022). 
As we mentioned in our RFI comments, TIA has labored over the past few years with 

industry and input from global government stakeholders to standardize supply chain risk 

mitigation (“SCRM”) best practices to ensure that ICT supply chains are built with security in 

mind. TIA believes SCS 9001, a process-based standard based on our quality management 

system capabilities, shows promise to provide a standardized supply chain assurance 

benchmarked across the ICT marketplace. NIST was correct in their Concept Paper to recognize 

the value of keeping the CSF’s Informative References robust and up to date, so that new 

standards that are built by the ICT industry between CSF revisions, such as SCS 9001, can still 

be included as a reference. 

TIA is in the process of releasing version 2.0 of SCS 9001, but we agree with the 

Concept Paper that there is clear value in providing mappings for how Informative Resources 

relate to the requirements of the CSF. Given SCS 9001 extensive processes focused on zero trust 

architecture, supplier trust principles, incident management and response all spread across 10 

security domains with 54 controls, we can see that there will likely be a significant overlap 

between the CSF and SCS 9001. As part of our work creating SCS 9001, we have mapped the 

standard to numerous industry best practices and government resources focused on security – 

Including version 1.1 of the CSF. In response to the Concept Paper’s Call to Action on mapping 

resources with the CSF, we are pleased to be able to submit our mapping of SCS 9001 to the 

CSF in the attached Appendix 1.2

 Additionally, we would be very interested in coordinating a 

mapping of version 2 of SCS 9001, once it is released, with the updated CSF, and look forward 

to working with NIST on this in the future. 

2

 TIA Technical Bulletin: How TIA QuEST Forum’s SCS 9001 Supply Chain Security Standard Operationalizes the 

National Standards and Technology Cybersecurity Framework 1.1 (available at https://tiaonline.org/what-wedo/technology-programs/supply-chain-security/). 

Appendix 1 

TIA Technical Bulletin 

How TIA QuEST Forum’s SCS 9001 Supply Chain 

Security Standard Operationalizes the National Standards 

and Technology Cybersecurity Framework 1.1 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

How TIA QuEST Forum’s SCS 9001 Supply Chain Security 

Standard Operationalizes the National Institute of 

Standards and Technology (NIST) Cybersecurity 

Framework 1.1 

August 2022 

Executive Summary 

World governments and their agencies are issuing publications, executive orders and in 

some cases, legislation intended to drive improvements in network resiliency and 

reduce impacts of cyber-attacks. Recent examples include U.S. Executive Order 

EO14028 and the U.K.’s Telecommunications Security Act of 2021. 

As an example, the U.S. government has approved the Infrastructure, Investment and 

Jobs Act (the IIJA). This law appropriates $42.4 billion to the new Broadband Equity, 

Access, and Deployment (or “BEAD”) Program. The BEAD program intends to provide 

broadband access through-out the entire United States and territories. The agency 

primarily responsible for administering the BEAD Program is the National 

Telecommunication and Information Agency (NTIA). The BEAD Program requires each 

state or territory (referred to as an “Eligible Entity”) to establish its own program for 

broadband deployment, subject to NTIA’s approval. NTIA will allocate to each Eligible 

Entity a share of BEAD Program funds based primarily on how many underserved 

locations are present within the state as compared to the rest of the country. 

The logistics of how the program is to operate is described within the publication 

“Notice of Funding Opportunity (or “NOFO”) which was released in May 2022. The 

NOFO includes a set of attestations that Eligible Entities are to receive from those 

network operators selected to build the infrastructure (referred to as “subgrantees”). 

These attestations are stated as “baseline requirements”. 

The NOFO requires that at a minimum, prior to allocating funds to a subgrantee, an 

Eligible Entity must receive attestation from the subgrantee that it has a 

cybersecurity risk management plan which “reflects the latest version of the National 

Institute of Standards and Technology (NIST) Framework for Improving Critical 

Infrastructure Cybersecurity (currently Version 1.1) and the standards and controls set 

forth in Executive Order 14028”. 

Page 1 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Further, the NOFO also requires that prior to allocating funds, an Eligible Entity must 

receive confirmation from the subgrantee that it has a supply chain risk management 

plan “based upon the key practices discussed in the NIST publication NISTIR 8276 Key 

Practices in Cyber Supply Chain Risk Management: Observations from Industry and 

related SCRM guidance within NIST 800-161 Cybersecurity Supply Chain Risk 

Management Practices for Systems and Organizations”. 

This TIA Technical Bulletin provides an overview of NIST’s NISTIR 8276 publication and 

how the Telecommunications Industry Associate (TIA) QuEST Forum’s SCS 9001 Supply 

Chain Security Standard can assist in realizing the requirements and recommendations 

stated therein. 

Introduction to the Telecommunications Industry Association (TIA) 

The Telecommunications Industry Association (TIA), the trusted industry association for the 

connected world, represents more than 400 global companies that enable high-speed 

communications networks and accelerate next-generation ICT innovation. Through leadership in 

U.S. and international advocacy, technology programs, standards development, and business 

performance solutions, TIA and its members are accelerating global connectivity across every 

industry and market. TIA is accredited by the American National Standards Institute (ANSI) and 

is active in developing and promoting international standards. 

TIA QuEST Forum brings together companies from around the world who manufacture, deploy 

and operate cutting edge networks, to develop process-based industry standards and tools to 

improve business performance and to address the challenges that come with digital 

transformation, new business models, innovation, and increasing competition. 

TIA’s QuEST Forum community built and maintains the ICT industry’s most prominent quality 

standard – TL 9000. As part of our commitment to ensuring global networks are reliable, 

trusted and secure, TIA QuEST Forum has released the “SCS 9001 Supply Chain Security 

Management System”, a process-based standard focused on supply chain security for the global 

Information and Communication Technology (ICT) industry. 

SCS9001 is the first comprehensive, measurable, and independently certifiable process-based 

supply chain security standard for the ICT industry and benchmarks performance to drive 

continuous improvement. This standard provides value to network operators of all types and 

developers and manufacturers of products and services used within those networks. 

Page 2 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Introduction to the National Institute of Standards and Technology and the 

Framework for Improving Critical Infrastructure Cybersecurity 

The National Institute of Standards and Technology (NIST) has been operating since 1901 and 

is part of the U.S. Department of Commerce. The Congress originally created NIST to improve 

U.S. industrial competitiveness, but the organization has grown significantly and is now 

influential across many industries and emerging technologies not the least of which are 

software development, cybersecurity, global communications networks and supply chain risk 

management. 

Recognizing the increasing risk of cyber-attacks, in February 2013, the President issued 

Executive Order (EO) 13636, “Improving Critical Infrastructure Cybersecurity”. This EO 

recognizes that the national and economic security of the United States depends on the reliable 

operation of critical infrastructure. The critical infrastructure intended for protection was 

defined in the U.S. Patriot Act of 2015 as: 

“Systems and assets, whether physical or virtual, so vital to the United States that the 

incapacity or destruction of such systems and assets would have a debilitating impact on 

security, national economic security, national public health or safety, or any combination of 

those matters.” 

The EO directed NIST to work with stakeholders to develop a cybersecurity framework based on 

existing standards, guidelines, and practices to reduce cyber risks to critical infrastructure. The 

outcome of this work is the NIST publication “Framework for Improving Critical Infrastructure 

Cybersecurity” (CSF). 

The CSF provides guidance and is based on existing standards, guidelines, and best practices 

for organizations to improve their operational processes to reduce cybersecurity risk. It is 

intended to be customized by individual organizations and organizations in response to their 

specific needs and risks. The CSF has been voluntary for industry prior to the BEAD NOFO but 

in Executive Order 13800, Strengthening the Cybersecurity of Federal Networks and Critical 

Infrastructure, the CSF was made mandatory for U.S. federal government agencies. 

While originally targeted at Critical Infrastructure, the CSF has evolved and can now be widely 

applied to help protect the network and IT assets of a variety of organizations across many 

industries. 

After EO 13636, the Cybersecurity Enhancement Act of 2014 bill was passed by Congress. This 

bill reinforces NIST’s role as set in EO 13636 and provides for “an ongoing, voluntary publicprivate partnership to improve cybersecurity, and to strengthen cybersecurity research and 

Page 3 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

development, workforce development and education, and public awareness and preparedness, 

and for other purposes.” 

The current version of the CSF is V1.1 and it was released in April 2018. NIST is currently 

working on a major update at the time of the writing of this Technical Bulletin, commonly 

referred to as V2.0. 

Overview of the NIST Cyber Security Framework1 

Organizations can use the CSF to help in identifying, assessing, and managing cybersecurity 

risk. It is not intended to replace existing processes; it is used to assist organizations with 

identifying gaps in implemented cybersecurity programs versus the intended end-state. The 

CSF complements existing cybersecurity practices and serves as the foundation for new 

cybersecurity programs or improvements to existing practices. 

The CSF is composed of three components: the Framework Core, 

the Framework Implementation Tiers, and the Framework 

Profiles. 

These components are briefly explained below. 

 Framework Core: a set of activities with desired outcomes 

from industry standards, guidelines, and best practices. The 

Core allows for communication of cybersecurity activities and 

outcomes within and across organizations. 

The Framework Core consists of five Key Functions named 

Identify, Protect, Detect, Respond, Recover. These Key 

Functions provide a high-level view of the lifecycle of an 

organization’s management of cybersecurity risk including the 

underlying Key Activities to be implemented. 

 Framework Implementation Tiers: The Tiers provide context on how an organization views 

cybersecurity risk and the processes in place to manage that risk. Tiers describe the degree 

to which an organization’s cybersecurity risk management practices follow the CSF. 

The Tiers are not a maturity model but are intended to demonstrate the advancement of 

the organization’s implementation of the CSF. The Tiers assess criteria of the implemented 

Risk Management Process, the existence of an Integrated Risk Management Program, and 

the level of External Participation in which the organization engages. 

A brief overview of each Tier follows. 

1 Certain content and graphics in this section are taken from NIST publications. 

Page 4 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

• Tier 1 – Partial: cybersecurity risk management practices are not formalized. Risk is 

managed in an ad hoc manner. There is limited awareness of cybersecurity risk across 

the organization. The organization has limited understanding of its role in the larger 

ecosystem with respect it’s dependencies and dependents and is generally unaware of 

the cyber supply chain risks of the products and services it provides and uses. 

• Tier 2 - Risk Informed: risk management practices are approved by management but 

may not be established as policy. There is an awareness of cybersecurity risk but an 

organization-wide approach managing the risk has not been established. Cybersecurity 

information is shared within the organization on an informal basis. Cyber risk 

assessment of organizational and external assets occurs but is not typically repeatable. 

The organization generally understands its role in the larger ecosystem and collaborates 

with and receives some information from other entities and generates some of its own 

information but not consistently. Finally, the organization is aware of the cyber supply 

chain risks associated with the products and services it provides and uses but does not 

act consistently upon those risks. 

• Tier 3 – Repeatable: the organization’s risk management practices are formalized. 

Organizational cybersecurity practices are regularly updated. There is an organizationwide approach to manage cybersecurity risk through documented policies, processes, 

and procedures. Personnel possess the knowledge and skills to perform their appointed 

roles and responsibilities. The organization consistently and accurately monitors 

cybersecurity risk of organizational assets. Senior executives ensure consideration of 

cybersecurity through all lines of operation in the organization. The organization 

understands its role, dependencies, and dependents in the larger ecosystem and 

collaborates with other entities. The organization is aware of the cyber supply chain risks 

associated with the products and services it provides and that it uses and acts upon 

those risks. 

• Tier 4 – Adaptive: the organization continuously adapts and improves its cybersecurity 

practices. There is an organization-wide approach to managing cybersecurity risk. The 

relationship between cybersecurity risk and organizational objectives is considered when 

making decisions. Cybersecurity risk is monitored in the same context as financial risk 

and other organizational risks. Cybersecurity risk management is engrained within the 

organizational culture. Established procedures enable quick reaction to changing 

objectives. The organization actively participates in the larger ecosystem of information 

sharing with collaborators. The organization uses real-time or near real-time 

information to act upon cyber supply chain risks associated with the products and 

services it provides and that it uses. Finally, the organization communicates proactively 

using formal agreements to develop and maintain strong supply chain relationships. 

 Framework Profile: the Profile can be characterized as the alignment of standards, 

guidelines, and practices to the Core. Profiles can be used to identify opportunities for 

improving cybersecurity posture by comparing the Current Profile (the level to which the 

organization has operationalized the CSF) to the Target Profile (the desired state). 

Page 5 







 

 

 

 

The NOFO requires that each Subgrantee have a plan that is operational prior to providing 

service that complies with: 

 U.S. Executive Order 14028 

 NIST Framework for Improving Critical Infrastructure Cybersecurity (the subject of this Tech 

Bulletin) 

 NISTIR 8276 Key Practices in Cyber Supply Chain Risk Management: Observations from 

Industry 

 NIST 800-161 Cybersecurity Supply Chain Risk Management Practices for Systems and 

Organizations as the requirements. 

SCS 9001 is a Cyber and Supply Chain security standard which demonstrates the proper 

operational hygiene of vendors in delivering products and services to organizations who 

operate networks, be they private or public. SCS 9001 was developed in support of network 

operators in evaluating their suppliers and providing higher assurance that vendors: 

 Operate their businesses with integrity and transparency 

 Conduct all aspects of operations and product development with a high level of security 

 Deliver products that are inherently higher in security and quality 

 Have made requisite investments to support products through their entire lifecycle, 

including the ability to more quickly identify, mitigate and resolve vulnerabilities found 

post-deployment. 

TIA has reviewed the BEAD NOFO baseline requirements and has confirmed that a certification 

to SCS 9001 will meet the requirements. Further, as SCS 9001 requires periodic recertifications, 

the standard is also useful in meeting the NOFO expectations that the Subgrantee plans be 

reevaluated and updated on a periodic basis and as events warrant. 

Finally, and specific to the NIST Cybersecurity Framework, certification to SCS 9001 provides 

assurance that the certifying organization has achieved the goals of the Tier 4 Adaptive 

Implementation Tier. 

Questions? Want more information about TIA QuEST Forum's SCS 9001? 

Visit: https://bit.ly/SCS9001 

Send us an email: supplychainsecurity@tiaonline.org 

Page 13 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

References 

 NIST Cybersecurity Framework (home page) 

Cybersecurity Framework | NIST 

 NIST Cybersecurity Framework Quick Start Guide – NIST Special Publication SP 1271 

Getting Started with the NIST Cybersecurity Framework: A Quick Start Guide 

 NIST Cybersecurity Framework V1.1 (full document) 

Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1 (nist.gov) 

 NIST Cybersecurity Framework V2.0 RFI Response Summary 

NIST Cybersecurity RFI Summary Analysis 

 U.S. Government BEAD Program 

Broadband Equity, Access, and Deployment (BEAD) Program | BroadbandUSA (doc.gov) 

 BEAD Program Notice of Funding Opportunity (NOFO) 

BEAD NOFO.pdf (doc.gov) 

 U.S. Executive Order 13636 

Executive Order -- Improving Critical Infrastructure Cybersecurity | whitehouse.gov (archives.gov) 

This document is not a Standard or TSB and does not modify any existing standards. This document is solely meant to 

communicate ideas and general information to industry. 

Page 14