National Cybersecurity Center of Excellence

Manufacturing Supply Chain Traceability – Traceability Chain MVP 

IoT Advisory Board

Wed 17 May 2023
TRACEABILITYFOCUS

• NCCoE project

• https://www.nccoe.nist.gov/projects/manufacturing-supply-chain-traceabilityusing-blockchain-related-technologies

• In Soliciting Comments phase

• Appliesto any manufacturing supply chain

• And to any assets flowing within

• Focus of this presentation is on Smart and Critical Infrastructure end uses

• CISA defines 16 critical infrastructures: https://www.cisa.gov/topics/criticalinfrastructure-security-and-resilience/critical-infrastructure-sectors

• Applicable to many critical manufacturing domains, including:

• IoT supply chain

• Chip-to-OT

This project will produce an MVP (Minimum Viable Product) as a starting point
KEYTRACEABILITYCHALLENGES

• From NIST IR 8419 (Apr 2022)

• Section 2.5: “Prior NIST documents treat each supply chain tier as having a ‘per acquirer’ perspective which providesrisk analysis context and highlights the 

challenge of establishing pedigree and provenance across multiple tiers. This 

document builds on that approach with an ecosystem perspective, and it recognizes the importance of certain acquirers who establish foundational traceability

requirements for a subset (ecosystem) of the supply chain.”

• Challenge #1

• Which acquirers have stringent traceability requirements?

• Who drives the traceability requirements?

• Challenge #2

• With current per acquirer perspective, how to trace through tiers?

• How are supply chains‘illuminated?’
TRACEABILITYSHIFTINPERSPECTIVE

Read 

when 

needed

Write

while

doing

Complement presenttracing methodsthrough tiers

with linked traceability records(traceability chain)

Source: 

Project 

Description of 

Traceability 

Chain:

Manufacturing

Supply Chain

Traceability with

Blockchain

Related

Technology

(nist.gov)
TRACEABILITYCHAIN

• Traceability Records written as components are made and assembled 

linked into a Traceability Chain (tree)

• Applies to any manufacturing supply chain (e.g., Mediledger [Pharma] in operation)

• Traceability Record types: Make, Assemble, Transport, Receive, Employ

• Durable regardless of company lifecycle (merger, acquisition, closure)

• Read Traceability Chain in reverse to validate components

• The final Traceability Record ‘Employ’ links the purchased components to where

they are installed, and where they are connected to enterprise IT

• Applicability

• Disaggregated supply chains

• Adoption can be modular, incrementally implemented where needed

• Can be used among industry affinity groups even prior to becoming a standard

• Traceability records can accommodate HBOM, SBOM, DBOM
TRACEABILITYCHAINWORKFLOW

• The traceability 

chain is created one 

blockchain 

transaction at a time 

by the relevant 

actors.

• The pedigree and 

provenance data in 

the traceability 

record is the same 

that would typically 

be exchanged bi- laterally in supplier- customer exchange.

Traceback 

traceability 

chain 

before 

writing 

Employ

Write Employ 

traceability 

record

Write Make 

traceability 

record

Write Make 

traceability 

record

Write 

Transport

traceability 

record

Link to physical products, orgs, people, and applicable ecosystem(s)

Hash link to preceding traceability record

<Industry>

Ecosystem

<Critical

Infrastructure>

Ecosystem Maker POC

Transport

POC

Transport

Firm

Receive

POC

Transport

Firm

Employ

POC

Employ

Decision

Critical

Infrastructure

Blockchain

Blockchain

Logistics

Software

Assembly Assembly POC

Stakeholder and 

Product

Traceability Chain (tree)

Write 

Assemble

traceability

record

Customer and Product

Decide if and how to use

Chip Pedigree Factory

Stakeholder and 

Product 

Manufacture

Stakeholder and 

Product

Manufacture

Manufacture

Stakeholder and 

Product 

Logistics

Stakeholder and 

Product

Logistics

Write Receive 

traceability 

record
EXAMPLECHAIN–MINIMUMDATAFIELDS

• Each Traceability Record 

is recorded in a 

blockchain transaction 

by a user with an ID

• A primary purpose of the 

Traceability Record is to 

memorialize supply chain 

activities and capture IDs 

of products, users, 

factories, etc.
MAKE

• Ecosystem ID 

(origination)

• Factory ID (organization)

• Product ID

• Maker POC ID

• Pedigree Statement ID
ASSEMBLE

• Ecosystem ID 

(origination)

• Assembly ID

• Assemble POC ID

• For each product 

included in the assembly

• Hash-link to Make 

traceability record

• Product ID in Make 

traceability record
TRANSPORT

• Ecosystem ID (origination)

• Factory ID (origination)

• Transport POC ID

• Transport Firm ID

• Ecosystem ID (destination)

• Consuming ID (destination 

organization)

• Hash-link to Assemble or 

Make traceability record

• Product ID (assemble or 

simple make)
RECEIVE

• Ecosystem ID (origination)

• Ecosystem ID (destination)

• Transport Firm ID

• Receive POC ID

• Hash link to transport 

record

• Product ID (assemble or 

simple make)

• Consuming ID (destination 

organization)
EMPLOY

• Ecosystem ID (final use in 

critical infrastructure, or 

equivalent)

• Critical Infrastructure (or equivalent) ID

• Employ POC ID

• Hash link to receive record

• Product ID (assemble or 

simple make)

• Link to employ risk 

assessment and decision
SUMMARY

• The Make and other 

Traceability Records can be 

specialized to the products (e.g, Make-chip, Make- software)

• The Traceability chain can be 

read to inform an Employ decision

• The Traceability Chain can be 

read later for forensic 

purposes

• Is protected from tampering

• Survives the lifespan of the 

supplier company
Current 

Project

Published Draft Project 

Description April 2023

Manufacturing Supply Chain Traceability Using BlockchainRelated Technologies | NCCoE (nist.gov)
GOING FORWARD

• The project is in Soliciting 

Comments phase

• Please provide input, using 

the comment process

• Please join the community 

of interest

Scroll down...
National Institute of Standards and Technology Smart Connected System Division

Michael Pease, michael.pease@nist.gov

Harvey Reed, hreed@mitre.org

The MITRE Corporation

https://www.nccoe.nist.gov/projects/manufacturing-supply-chain-traceability-using- blockchain-related-technologies

nccoe.nist.gov @NISTcyber