# Collaboration Practices for the Cybersecurity of Supply Chains to Critical Infrastructure
## 1 Introduction  
In recent years, cybersecurity events impacting Critical National Infrastructure (CNI) have been increasing in quantity and importance [1; 2; 3]. The use of the supply chain as an attack vector has increased significantly, with incidents having a knock-on effect on many organizations via their trusted supplier networks. Such events have highlighted the importance of collaborative approaches and a more coordinated and consistent preparation and response to cybersecurity. This is a global issue due to dependencies on international supply chains and similar equipment being used in critical infrastructure in many countries.  
Cybersecurity is a shared problem, and it requires shared understanding and partnership to address it. However, policy interventions and resulting regulations can only focus on the cybersecurity obligations of individual organizations. End-to-end security for the technical solutions and services that encompass multiple actors requires interorganizational responses. The effective transfer of risk management responsibilities between organizations and the dividing up of responsibility and accountability is a challenge because the risks are shared in a technically interdependent solution operating across organizationally independent governance structures.  
In an attempt to address this, regulations have placed expectations on operators of CNI to take responsibility for the cybersecurity of their supply chains where there is potential impact on the essential services that they provide to society. The cybersecurity assurance of third parties has therefore become more important both during procurement and throughout the lifecycle of a product or service. Due to the scale of dependency on thesupply chain, managing these assurance processes as individual organizations involves significant overhead for both customers and suppliers unless a more consistent and shared approach can be adopted. Furthermore, a concentration of risk and dependencies in the supply chain, where there is over-reliance on a few specialized suppliers, is leading to regulators considering regulations also being placed directly on important entities in the supply chain [4,5].  
The end-to-end oversight of supply chains for critical infrastructure therefore requires a governance approach where a collective response to cybersecurity can be prepared, uplifting security practices where needed most. This work has defined and built a Supply Chain Expert Group (SCEG) [6], a community of several organizations and individual experts, which recognizes the need to collectively achieve cybersecurity objectives that cannot be addressed by a single organization. This community provides an example of collaborative governance through the willingness of cybersecurity professionals to work across organizational boundaries to protect critical infrastructures more effectively. Its work focuses on the CNI sectors using Operational Technology (OT), including energy, transport, water, health, and food sectors. This enables the pooling of knowledge and gathering experiences from the group to translate into useable guidance consistent across supply chains. It also looks at the creation of practical and simplified guidance to assist companies with fewer resources for cybersecurity. Bringing together cross-sector input to these issues and cross-pollinating experience from other sectors is also assisting progress by stimulating new ideas and solutions. This collaboration is providing a bridge between the UK National Cyber Security Centre (NCSC), private sector companies, and lead Government departments to improve cyber resilience and ensure the policy and regulatory stance is applicable to the technical solutions that form our critical infrastructures. These issues are globally relevant and are also receiving attention from US Government and European Commission initiatives.