Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER TWO > 2.8 SUPPLY CHAIN RISK MANAGEMENT

CHAPTER TWO

individuals, other organizations, or the Nation are acceptable based on the organization's risk
management strategy and organizational risk tolerance.45

2.8 SUPPLY CHAIN RISK MANAGEMENT

Organizations are becoming increasingly reliant on products, systems, and services provided by
external providers to carry out missions and business functions. Organizations are responsible
and accountable for the risk incurred when using such component products, systems, and
services.46 Relationships with external providers can be established in a variety of ways, for
example, through joint ventures, business partnerships, various types of formal agreements
(e.g., contracts, interagency agreements, lines of business arrangements, licensing agreements),
or outsourcing arrangements.
The growing dependence on products, systems, and services from external providers, along with
the nature of the relationships with those providers, present an increasing amount of risk to an
organization. Risk may increase based on the likelihood of occurrence and adverse impact from
threat events such as the insertion of counterfeits, unauthorized production, tampering, theft,
insertion of malicious software and hardware, as well as poor manufacturing and development
practices in the supply chain, including the failure to build in security or privacy capabilities that
enable an organization to better manage risk in its environment.
Supply chain risks can be endemic or systemic within a system element, system, organization,
sector, or nation. While the singular use of a system element or service within a system may
present an acceptable risk to an organization, its common or extended use throughout a system,
organization, sector or nation can raise the risk to an unacceptable level. These risks are often
associated with the global and distributed nature of product and service supply chains and an
organization's decreased visibility into, and understanding of, how the technology that they
acquire is developed, integrated, and deployed. This includes the processes, procedures, and
practices used to assure the integrity, security, resilience, privacy capabilities, and quality of the
acquired products, systems, and services.
To address supply chain risks, organizations develop an SCRM policy, which is an important
vehicle for directing SCRM activities. Guided and informed by applicable laws, executive orders,
directives, policies, and regulations, the SCRM policy supports applicable organizational policies
(e.g., acquisition and procurement, information security and privacy, logistics, quality, and
supply chain). The policy addresses the goals and objectives in the organization's strategic plan,
missions and business functions, and the internal and external customer requirements. It also
defines the integration points for SCRM with the risk management and the SDLC processes for
the organization. Finally, the SCRM policy defines the SCRM roles and responsibilities within the
organization, any dependencies among those roles, and the interaction among the roles. SCRM
roles specify the responsibilities for procurement, conducting risk assessments, collecting supply
chain threat intelligence, identifying and implementing risk-based mitigations, and performing
monitoring functions.
45 See RMF Prepare-Organization Level step, Task P-2.
46 [OMB A-130] defines supply chain risk and requires federal agencies to consider supply chain security issues for all
resource planning and management activities throughout the SDLC so that risks are appropriately managed.