CISCO

The bridge to possible

Cisco Public

Notice and Request for Information

about Evaluating and Improving

Cybersecurity Resources: The

Cybersecurity Framework and

Cybersecurity Supply Chain Risk

Management

Cisco's response to the U.S. Department of Commerce

National Institute of Standards and Technology (NIST)

Request for Information

May 3, 2022
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

CISCO

The bridge to possible

May 3, 2022

Cisco Systems would like to thank the NationalInstitute of Standardsand Technology (NIST) for

the opportunity to provide this response to the Notice and Request for Information about Evaluating and Improving Cybersecurity Resources: The Cybersecurity Framework and Cybersecurity Supply Chain Risk Management(RFI).I Cisco recognizesthe value of standards based,process oriented best practices for cybersecurity supply chain risk management and appreciates the work NIST does

to advance this goal.

Cisco recommends the following considerationsas NIST develops updates for the Cybersecurity Framework (CSF) and Cybersecurity SupplyChainRisk Managementleveraging feedback received

in response to the RFI:

• First, Cisco believessupplychain risk managementshouldfocus more attentionon the

end to end security of the lifecycle of key products—leveragingtrustworthy technologies and integrity verification to validate secure supply chains.Trustworthy technology examples for NIST to consider include: digital software image signing;

hardware anchored secure boot; establishinga chain of trust for criticalsoftware;Trust

Anchor Modules; and runtime defenses. Security features at the operating system,

application, and data layers can then be built upon a foundationof trust anchoredto

hardware.

• Second, Cisco recommends that third party risk management should be more

integrated with the CSF as core business practices, rather than solely relying on secondary

frameworks. Trends in the attack landscape necessitate increased vigilance surrounding all

interactions with third parties. This integration should include, at a minimum: 1) controls

recommendingthat vendors provide lists of authorizedand continuouslyreevaluated

resellers; and 2) controls guiding best practices for data governance and security guidelines

for data shared with or stored by third parties.Cisco believesNIST SpecialPublication

(SP) 800-53 Rev. 5 identified the right Supply Chain Risk Management (SCRM) controls

for vendorsto map to.2 By way of example,Cisco has successfullymapped our Value

Chain SecurityArchitecture,TrustworthyTechnologies,Policies,Procedures and Teams

to each relevant control, as illustrated below. The CSF should move towards incorporating

similar SCRM controls, most notably SR-4-3, Identify as Genuine and Not Altered, SR-9,

Tamper Resistance and Detection, and SR-11, Component Authenticity. These integrations

will advance the goal ofseeding greater adoption across govemment, critical infrastructure,

and enterprises.

1 https://www.federalregister.gov/documents/2022/02/22/2022 03642/evaluating and improving nist-cybersecurity resources the

cybersecurity framework and cybersecurity

2 https://csrc.nist.gov/pubIications/detail/sp/800 53/rev 5/finaI

- -

- -

- - - - - - -

- - -

- -

-

-
 

 

 

 

 

 

 

 

Cisco

The bridge to possible

Lastly, to assist adherence to Executive Order 14028,3 NIST should provide guidance on

how the CSF should be applied alongside the Secure Software Development

Framework (SSDF). One way to do this could be to map the SSDF Practices and Tasks

as Informative References in the CSF.

Cisco looks forward to the results of this enhancementto cybersecurity resources and the benefits it

will bring across organizations. We thank you again for your consideration.

Sincerely yours,

DocuSigned by:

Timothy Wilson Johnston, Value Chain Security Leader,

@cisco.com

DocuSigned by:

04A598590121432.„

Eric Wenger, Senior Director, Technology Policy

cisco.com

3 https://www.whitehouse.gov/briefing room/presidential actions/2021/05/12/executive-order on improving the-nations-cybersecurity/ - - - - -

-
 

 

CISCO

The bridge to possible

Cisco Systems MST 800-53 Rev. 5 SCRMMapping

CISCO

NIST800-53

SCRM Mapping

POfi%snd Procedures

Supp y Chain Risk usnsgem,ent Plan

Estab&shSCRM Team

Chain Controls Processes

Diverse Suppo•Base

Lirnitation ot Harm

Sub-Tier Down

Provenance

Identity

Track and %aee

ss Genuine

NotAltered

SuppCyChain Pedgree

AcquisitionSuzte*s,

end Methods

Adequate Supply

AssessrnentgPrior toSeuetion,

Acceptetce. or Update

Suppur Assessments andReviews

Testing and Analysis

Supp S Cttalihoperations Security

Notification

Resistanceand

MultipleStages Of System

Deveøopment

St-to inspection of Systems and Components

ComponentAuthet•melty

Anti Countedeit Treting

Config Control tot

Ser•.Sce arid Repair

Anti CounterteitScanning

CorpoonentDisposal

Cisco Pubic

' 

' 

-

' ' 

—

—