The design and development of information systems can be complex undertakings, consisting of a multitude of pieces of equipment and software products, and service providers. Each of the components of an information system may rely on one or more supply chains—that is, the set of organizations, people, activities, information, and resources that create and move a product or service from suppliers to an organization’s customers. Obtaining a full understanding of the sources of a given information system can also be extremely complex. According to the Software Engineering Institute, the identity of each product or service provider may not be visible to others in the supply chain. Typically, an acquirer, such as a federal agency, may only know about the participants to which it is directly connected in the supply chain. Further, the complexity of corporate structures, in which a parent company (or its subsidiaries) may own or control companies that conduct business under different names in multiple countries, presents additional challenges to fully understanding the sources of an information system. As a result, the acquirer may have little visibility into the supply chains of its suppliers. Federal procurement law and policies promote the acquisition of commercial products when they meet the government’s needs. Commercial providers of IT use a global supply chain to design, develop, manufacture, and distribute hardware and software products throughout the world. Consequently, the federal government relies heavily on IT equipment manufactured in foreign nations. Federal information and communications systems can include a multitude of IT equipment, products, and services, each of which may rely on one or more supply chains. These supply chains can be long, complex, and globally distributed and can consist of multiple tiers of outsourcing. As a result, agencies may have little visibility into, understanding of, or control over how the technology that they acquire is developed, integrated, and deployed, as well as the processes, procedures, and practices used to ensure the integrity, security, resilience, and quality of the products and services. Table 1 highlights possible manufacturing locations of typical components of a computer or information systems network. Moreover, many of the manufacturing inputs required for these components—whether physical materials or knowledge—are acquired from various sources around the globe. Figure 1 depicts the potential countries of origin of common suppliers of various components in a commercially available laptop computer. The Federal Information Security Modernization Act (FISMA) of 2014 requires federal agencies to develop, document, and implement an agency-wide information security program to provide information security for the information systems and information that support the operations and assets of the agency. The act also requires that agencies ensure that information security is addressed throughout the life cycle of each agency information system. FISMA assigns NIST the responsibility for providing standards and guidelines on information security to agencies. In addition, the act authorizes DHS to develop and issue binding operational directives to agencies, including directives that specify requirements for the mitigation of exigent risks to information systems. NIST has issued several special publications (SP) that provide guidelines to federal agencies on controls and activities relevant to managing supply chain risk. For example, NIST SP 800-39 provides an approach to organization-wide management of information security risk, which states that organizations should monitor risk on an ongoing basis as part of a comprehensive risk management program. NIST SP 800-53 (Revision 4) provides a catalogue of controls from which agencies are to select controls for their information systems. It also specifies several control activities that organizations could use to provide additional supply chain protections, such as conducting due diligence reviews of suppliers and developing acquisition policy, and implementing procedures that help protect against supply chain threats throughout the system development life cycle. NIST SP 800-161 provides guidance to federal agencies on identifying, assessing, selecting, and implementing risk management processes and mitigating controls throughout their organizations to help manage information and communications technology supply chain risks. In addition, as of June 2018, DHS has issued one binding operational directive related to an IT supply chain-related threat. Specifically, in September 2017, DHS issued a directive to all federal executive branch departments and agencies to remove and discontinue present and future use of Kaspersky-branded products on all federal information systems. In consultation with interagency partners, DHS determined that the risks presented by these products justified their removal. Beyond these guidelines and requirements, the Ike Skelton National Defense Authorization Act for Fiscal Year 2011 also included provisions related to supply chain security. Specifically, Section 806 authorizes the Secretaries of Defense, the Army, the Navy, and the Air Force to exclude a contractor from specific types of procurements on the basis of a determination of significant supply chain risk to a covered system. Section 806 also establishes requirements for limiting disclosure of the basis of such procurement action. In several reports issued since 2012, we have pointed out that the reliance on complex, global IT supply chains introduces multiple risks to federal information and telecommunications systems. This includes the risk of these systems being manipulated or damaged by leading foreign cyber-threat nations such as Russia, China, Iran, and North Korea. Threats and vulnerabilities created by these cyber-threat nations, vendors or suppliers closely linked to cyber-threat nations, and other malicious actors can be sophisticated and difficult to detect and, thus, pose a significant risk to organizations and federal agencies. As we reported in March 2012, supply chain threats are present at various phases of a system’s development life cycle. Key threats that could create an unacceptable risk to federal agencies include the following. Installation of hardware or software containing malicious logic, which is hardware, firmware, or software that is intentionally included or inserted in a system for a harmful purpose. Malicious logic can cause significant damage by allowing attackers to take control of entire systems and, thereby, read, modify, or delete sensitive information; disrupt operations; launch attacks against other organizations’ systems; or destroy systems. Installation of counterfeit hardware or software, which is hardware or software containing non-genuine component parts or code. According to the Defense Department’s Information Assurance Technology Analysis Center, counterfeit IT threatens the integrity, trustworthiness, and reliability of information systems for several reasons, including the facts that (1) counterfeits are usually less reliable and, therefore, may fail more often and more quickly than genuine parts; and (2) counterfeiting presents an opportunity for the counterfeiter to insert malicious logic or backdoors into replicas or copies that would be far more difficult in more secure manufacturing facilities. Failure or disruption in the production or distribution of critical products. Both man-made (e.g., disruptions caused by labor, trade, or political disputes) and natural (e.g., earthquakes, fires, floods, or hurricanes) causes could decrease the availability of material needed to develop systems or disrupt the supply of IT products critical to the operations of federal agencies. Reliance on a malicious or unqualified service provider for the performance of technical services. By virtue of their position, contractors and other service providers may have access to federal data and systems. Service providers could attempt to use their access to obtain sensitive information, commit fraud, disrupt operations, or launch attacks against other computer systems and networks. Installation of hardware or software that contains unintentional vulnerabilities, such as defects in code that can be exploited. Cyber attackers may focus their efforts on, among other things, finding and exploiting existing defects in software code. Such defects are usually the result of unintentional coding errors or misconfigurations, and can facilitate attempts by attackers to gain unauthorized access to an agency’s information systems and data, or disrupt service. We noted in the March 2012 report that threat actors can introduce these threats into federal information systems by exploiting vulnerabilities that could exist at multiple points in the global supply chain. In addition, supply chain vulnerabilities can include weaknesses in agency acquisition or security procedures, controls, or implementation related to an information system. Examples of the types of vulnerabilities that could be exploited include acquisitions of IT products or parts from sources other than the original manufacturer or authorized reseller, such as independent distributors, brokers, or on the gray market; lack of adequate testing for software updates and patches; and incomplete information on IT suppliers. If a threat actor exploits an existing vulnerability, it could lead to the loss of the confidentiality, integrity, or availability of the system and associated information. This, in turn, can adversely affect an agency’s ability to carry out its mission. In March 2012, we reported that the four national security-related agencies (i.e., Defense, Justice, Energy, and DHS) had acknowledged the risks presented by supply chain vulnerabilities. However, the agencies varied in the extent to which they had addressed these risks by (1) defining supply chain protection measures for department information systems, (2) developing implementing procedures for these measures, and (3) establishing capabilities for monitoring compliance with, and the effectiveness of, such measures. Of the four agencies, the Department of Defense had made the most progress addressing the risks. Specifically, the department’s supply chain risk management efforts began in 2003 and included: a policy requiring supply chain risk to be addressed early and across a system’s entire life cycle and calling for an incremental implementation of supply chain risk management through a series of pilot projects; a requirement that every acquisition program submit and update a “program protection plan” that was to, among other things, help manage risks from supply chain exploits or design vulnerabilities; procedures for implementing supply chain protection measures, such as an implementation guide describing 32 specific measures for enhancing supply chain protection and procedures for program protection plans identifying ways in which programs should manage supply chain risk; and a monitoring mechanism to determine the status and effectiveness of supply chain protection pilot projects, as well as monitoring compliance with and effectiveness of program protection policies and procedures for several acquisition programs. Conversely, our report noted that the other three agencies had made limited progress in addressing supply chain risks for their information systems. For example: The Department of Justice had defined specific security measures for protecting against supply chain threats through the use of provisions in vendor contracts and agreements. Officials identified (1) a citizenship and residency requirement and (2) a national security risk questionnaire as two provisions that addressed supply chain risk. However, Justice had not developed procedures for ensuring the effective implementation of these protection measures or a mechanism for verifying compliance with, and the effectiveness of these measures. We stressed that, without such procedures, Justice would have limited assurance that its departmental information systems were being adequately protected against supply chain threats. In May 2011, the Department of Energy revised its information security program, which required Energy components to implement provisions based on NIST and Committee on National Security Systems guidance. However, the department was unable to provide details on implementation progress, milestones for completion, or how supply chain protection measures would be defined. Because it had not defined these measures or associated implementing procedures, we reported that the department was not in a position to monitor compliance or effectiveness. Although its information security guidance mentioned the NIST control related to supply chain protection, DHS had not defined the supply chain protection control activities that system owners should employ. The department’s information security policy manager stated that DHS was in the process of developing policy that would address supply chain protection, but did not provide details on when it would be completed. In the absence of such a policy, DHS was not in a position to develop implementation procedures or to monitor compliance or effectiveness. To assist Justice, Energy, and DHS in better addressing IT supply chain- related security risks for their departmental information systems, we made eight recommendations to these three agencies in our 2012 report. Specifically, we recommended that Energy and DHS: develop and document departmental policy that defines which security measures should be employed to protect against supply chain threats. We also recommended that Justice, Energy, and DHS: develop, document, and disseminate procedures to implement the supply chain protection security measures defined in departmental policy, and develop and implement a monitoring capability to verify compliance with, and assess the effectiveness of, supply chain protection measures. The three agencies generally agreed with our recommendations and, subsequently, implemented seven of the eight recommendations. Specifically, we verified that Justice and Energy had implemented each of the recommendations we made to them by 2016. We also confirmed that DHS had implemented two of the three recommendations we made to that agency by 2015. However, as of fiscal year 2016, DHS had not fully implemented our recommendation to develop and implement a monitoring capability to verify compliance with, and assess the effectiveness of, supply chain protections. Although the department had developed a policy and approach for monitoring supply chain risk management activities, it could not provide evidence that its components had actually implemented the policy. Thus, we were not able to close the recommendation as implemented. Nevertheless, the implementation of the seven recommendations and partial implementation of the eighth recommendation better positioned the three agencies to monitor and mitigate their IT supply chain risks. In addition, we reported in March 2012 that the four national security- related agencies had participated in interagency efforts to address supply chain security, including participation in the Comprehensive National Cybersecurity Initiative, development of technical and policy tools, and collaboration with the intelligence community. In support of the cybersecurity initiative, Defense and DHS jointly led an interagency initiative on supply chain risk management to address issues of globalization affecting the federal government’s IT. Also, DHS had developed a comprehensive portfolio of technical and policy-based product offerings for federal civilian departments and agencies, including technical assessment capabilities, acquisition support, and incident response capabilities. The efforts of the four agencies could benefit all federal agencies in addressing their IT supply chain risks. In summary, the global IT supply chain introduces a myriad of security risks to federal information systems that, if realized, could jeopardize the confidentiality, integrity, and availability of federal information systems. Thus, the potential exists for serious adverse impact on an agency’s operations, assets, and employees. These factors highlight the importance and urgency of federal agencies appropriately assessing, managing, and monitoring IT supply chain risk as part of their agencywide information security programs. Chairmen King and Perry, Ranking Members Rice and Correa, and Members of the Subcommittees, this completes my prepared statement. I would be pleased to answer your questions. If you have any questions regarding this statement, please contact Gregory C. Wilshusen at (202) 512-6244 or wilshuseng@gao.gov. Other key contributors to this statement include Jeffrey Knott (assistant director), Christopher Businsky, Nancy Glover, and Rosanna Guerrero. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: IT systems are essential to the operations of the federal government. The supply chain—the set of organizations, people, activities, and resources that create and move a product from suppliers to end users—for IT systems is complex and global in scope. The exploitation of vulnerabilities in the IT supply chain is a continuing threat. Federal security guidelines provide for managing the risks to the supply chain. This testimony statement highlights information security risks associated with the supply chains used by federal agencies to procure IT systems. The statement also summarizes GAO's 2012 report that assessed the extent to which four national security-related agencies had addressed such risks. To develop this statement, GAO relied on its previous reports, as well as information provided by the national security-related agencies on their actions in response to GAO's previous recommendations. GAO also reviewed federal information security guidelines and directives. Reliance on a global supply chain introduces multiple risks to federal information systems. Supply chain threats are present during the various phases of an information system's development life cycle and could create an unacceptable risk to federal agencies. Information technology (IT) supply chain-related threats are varied and can include: installation of intentionally harmful hardware or software (i.e., containing “malicious logic”); installation of counterfeit hardware or software; failure or disruption in the production or distribution of critical products; reliance on malicious or unqualified service providers for the performance of technical services; and installation of hardware or software containing unintentional vulnerabilities, such as defective code. These threats can have a range of impacts, including allowing adversaries to take control of systems or decreasing the availability of materials needed to develop systems. These threats can be introduced by exploiting vulnerabilities that could exist at multiple points in the supply chain. Examples of such vulnerabilities include the acquisition of products or parts from unauthorized distributors; inadequate testing of software updates and patches; and incomplete information on IT suppliers. Malicious actors could exploit these vulnerabilities, leading to the loss of the confidentiality, integrity, or availability of federal systems and the information they contain. GAO reported in 2012 that the four national security-related agencies in its review—the Departments of Defense, Justice, Energy, Homeland Security (DHS)—varied in the extent to which they had addressed supply chain risks. Of the four agencies, Defense had made the most progress addressing the risks. It had defined and implemented supply chain protection controls, and initiated efforts to monitor the effectiveness of the controls. Conversely, Energy and DHS had not developed or documented policies and procedures that defined security measures for protecting against IT supply chain threats and had not developed capabilities for monitoring the implementation and effectiveness of the measures. Although Justice had defined supply chain protection measures, it also had not developed or documented procedures for implementing or monitoring the measures. Energy and Justice fully implemented the recommendations that GAO made in its 2012 report and resolved the deficiencies that GAO had identified with their supply chain risk management efforts by 2016. DHS also fully implemented two recommendations to document policies and procedures for defining and implementing security measures to protect against supply chain threats by 2015, but could not demonstrate that it had fully implemented the recommendation to develop and implement a monitoring capability to assess the effectiveness of the security measures. In its 2012 report, GAO recommended that Justice, Energy, and DHS take eight actions, as needed, to develop and document policies, procedures, and monitoring capabilities that address IT supply chain risk. The departments generally concurred with the recommendations and subsequently implemented seven recommendations and partially implemented the eighth recommendation.