Information systems can be complex undertakings consisting of a multitude of pieces of equipment, software products, and service providers. Each of these components may rely on one or more supply chains. Obtaining a full understanding of the sources of a given information system during initiation and development can also be extremely complex. According to the Software Engineering Institute (SEI), the identity of each product or service provider may not be visible to others in the supply chain. Typically, an acquirer (such as a federal agency) will only know about the participants directly connected to it in the supply chain. As a result, an acquirer will have little visibility into the supply chains of its suppliers. For example, a program office at a federal agency may rely on a prime contractor to acquire, develop, and maintain an information system. In turn, the prime contractor may obtain the equipment, software, and services that constitute the system through various means, including the reuse of existing equipment or legacy software; outsourcing of system development to an additional supplier; development of the capability in-house; or acquisition of the capability directly from a supplier or commercial off- the-shelf-vendor, or through open-source means. In addition, the complexity of corporate structures, in which a parent company (or its subsidiaries) may own or control IT companies that conduct business under different names in multiple countries, presents additional challenges to obtaining a full understanding of the source of an information system. According to NIST, today’s complex global economy and manufacturing practices make corporate ownership and control more ambiguous when assessing supply chain vulnerabilities. For example, foreign-based companies sometimes manufacture and assemble products and components in the United States, and U.S.-based companies sometimes manufacture products and components overseas, or domestically employ foreign workers. Commercial providers of IT use a global supply chain to design, develop, manufacture, and distribute hardware and software products throughout the world. Many of the manufacturing inputs required for those products— whether physical materials or knowledge—are acquired from various sources around the globe. Figure 1 depicts the potential countries of origin of the common suppliers for various components within a commercially available computer. Federal procurement law and policies promote the acquisition of commercial products when they meet the government’s needs. For example, provisions of the Federal Acquisition Streamlining Act of 1994 are designed to encourage the government to buy commercial items by (1) requiring a preference for commercial items where feasible, and (2) making exceptions to certain government requirements that previously discouraged commercial vendors from offering their products and services to the government. In addition, Office of Management and Budget (OMB) Circular A-130 requires that agencies select investments in information technology (such as computers, software, firmware, and support services) that, among other things, make maximum use of commercial, off-the-shelf technology. OMB Circular A-130 also requires that agencies acquire off-the-shelf software from commercial sources unless developing custom software has been documented as more cost- effective. In 2008, the Bush administration began to implement a series of initiatives, referred to as the Comprehensive National Cybersecurity Initiative (CNCI), aimed primarily at improving cybersecurity within the federal government. Specifically, CNCI is composed of a set of 12 initiatives with the objective of safeguarding federal executive branch information systems by reducing potential vulnerabilities; protecting against intrusion attempts; and anticipating future threats through defensive, offensive, educational, research and development, and counterintelligence efforts. One of the CNCI initiatives focused on developing a multipronged approach for addressing global supply chain risk management. Specifically, the initiative stated that risks stemming from both the domestic and global supply chains must be managed in a strategic and comprehensive way over the entire life cycle of products, systems, and services. It further states that managing this risk will require a greater awareness of the threats, vulnerabilities, and consequences associated with acquisition decisions; the development and employment of tools and resources to technically and operationally mitigate risk across the life cycle of products (from design through retirement); the development of new acquisition policies and practices that reflect the complex global marketplace; and partnership with industry to develop and adopt supply chain risk management standards and best practices. In March 2010, we reported on the actions that had been taken to develop interagency mechanisms to plan and coordinate CNCI activities and the challenges the CNCI faced in achieving its objectives related to securing federal information systems. We determined that the White House and federal agencies had taken steps to plan and coordinate CNCI activities by establishing several interagency work groups. We also determined that the CNCI faced several challenges in meeting its objectives, including defining roles and responsibilities, establishing measures of effectiveness, and establishing an appropriate level of transparency (including for supply chain risk management activities). We made six recommendations to OMB to address the identified challenges. OMB concurred with five of our six recommendations and has since taken steps to address most of these challenges, including clarifying cybersecurity responsibilities and activities among federal entities. The Federal Information Security Management Act of 2002 (FISMA) establishes federal agency information security program requirements that support the effectiveness of information security controls over information resources that support federal operations and assets. Its framework creates a cycle of risk management activities necessary for an effective security program. FISMA requires every federal agency to establish an information security program. Additionally, the act assigns responsibility to NIST to provide standards and guidelines to agencies on information security. FISMA directed NIST to promulgate federal standards for (1) the security categorization of federal information and information systems based on the objective of providing appropriate levels of information security according to a range of risk levels, and (2) minimum security requirements for information and information systems in each such category. NIST subsequently issued two Federal Information Processing Standards (FIPS): FIPS 199 is to be used to categorize information and information systems, thereby providing a common framework for expressing security. Under this standard, a system is categorized (high, moderate, or lowa loss of confidentiality, integrity, or availability. ) based on the type of impact that would result from FIPS 200 addresses the specification of minimum security In requirements for federal information and information systems. particular, FIPS 200 directs federal agencies to meet the minimum security requirements through the use of the security controls in accordance with NIST Special Publication 800-53 (SP 800-53). NIST, FIPS Publication 200: Minimum Security Requirements for Federal Information and Information Systems (Gaithersburg, Md. : March 2006). NIST identified several specific measures that organizations could use to provide additional supply chain protections. These include, but are not limited to, conducting a due diligence review of suppliers prior to entering into contractual agreements to acquire information system hardware, software, firmware, or services; using trusted shipping and warehousing for information systems, information system components, and information technology products; and employing independent analysis and penetration testing against delivered information systems, information system components, and information technology products. SP 800-53, Revision 3, also includes a security control for system and Thus, for systems services acquisition policy and procedures (SA-1). where both controls are selected, agencies should develop, disseminate, and review acquisition policy and implementing procedures that help protect against supply chain threats throughout the system development life cycle. Other policy requires SP 800-53 controls to be selected for both non- national security and national security systems. Specifically, OMB Circular A-130 states that federal agencies are required to use SP 800-53 in selecting and specifying controls for non-national security programs. Also, in October 2009, the Committee on National Security Systems published Instruction 1253, which establishes SP 800-53 as a common foundation for information security controls for national security systems. Under this instruction, all national security systems are directed to select SA-1 as part of their initial control baselines. Further, all national security systems that are categorized as high or moderate impact for integrity are directed to select SA-12 as part of their initial control baselines. In March 2011, NIST published SP 800-39, which provides an approach for organizationwide management of information security risk, including those related to supply chains. Among other things, the publication states that risk management requires organizations to monitor risk on an ongoing basis as part of a comprehensive risk management program. Monitoring programs can aid agency officials in oversight of currently implemented security controls. To support risk monitoring, organizations are expected to describe how compliance with security requirements is verified and how the organization will determine the effectiveness of risk response activities. In addition, the Ike Skelton National Defense Authorization Act for Fiscal Year 2011 included provisions related to supply chain security. Specifically, Section 806 authorizes the Secretaries of Defense, the Army, the Navy, and the Air Force to exclude a contractor from specified types of procurements on the basis of a determination of significant supply chain risk to a covered system. Section 806 also establishes requirements for limiting disclosure of the basis of such procurement action. In June 2010, NIST released a draft interagency report, Piloting Supply Chain Risk Management Practices for Federal Information Systems, which, when finalized and published, is intended to provide agencies with supply chain risk mitigation strategies integrated with the information systems development life cycle. Its methodology for handling supply chain risk included, among other things, determining which procurements should consider supply chain risk, working with agency stakeholders to help mitigate supply chain risk, and describing roles and responsibilities within the agency. NIST plans to release the final version of the report by the end of fiscal year 2012. In February 2012, NIST released for comment the initial public draft of SP 800-53, Revision 4, which, when finalized and published, is intended to provide, among other things, additional supply chain-related guidance and protection measures. The draft revised SA-12 guidance and incorporated supply chain considerations into, among other things, security measures related to incident handling and reporting. NIST anticipates the publication of the final document in July 2012.