Cyber Supply Chain Risk Management: An Introduction (CRS Report for Congress)
| Release Date |
Revised March 21, 2022 |
| Report Number |
IF10920 |
| Report Type |
In Focus |
| Authors |
Chris Jaikaran |
| Source Agency |
Congressional Research Service |
| Older Revisions |
-
Premium Revised Dec. 15, 2020 (83 pages, $24.95)
add
-
Premium Revised June 29, 2018 (2 pages, $24.95)
add
-
Premium June 9, 2018 (2 pages, $24.95)
add
|
Summary:
A supply chain consists of the system of organizations,
people, activities, information, and resources that provide
products or services to consumers. Like other types of
goods, a global supply chain exists for the development,
manufacture, and distribution of information technology
(IT) products (i.e., hardware and software). Recent media
have highlighted the risks posed to IT from the supply
chain.
In 2017, the U.S. Department of Homeland Security (DHS)
ordered federal agencies to remove Kaspersky security
products from their networks because of risk they posed.
Legislation was subsequently enacted codifying that order.
In addition, stories of persistent administrative passwords
on devices or otherwise vulnerable products allowing
unauthorized access to sensitive networks became more
frequent.
This year, Congress is considering additional measures to
promote cyber supply chain security (H.R. 5515 and S.
3085). Among other recent developments, DHS says they
are investigating cyber supply chain security further; the
Federal Communications Commission is considering
prohibiting foreign telecommunications equipment for
domestic use; and the U.S.-China Economic and Security
Review Commission has issued a report highlighting supply
chain concerns.
While interest in cyber supply chain security has increased
recently, there have been other periods of intense scrutiny
on supply chain issues. In 2012, for example, the White
House issued a report on global supply chain security; the
House Permanent Select Committee on Intelligence
(HPSCI) released an unclassified report on threats from
Chinese multinational companies Huawei and ZTE; ZTE
was exposed selling phones in the United States with
backdoor access; the Director of National Intelligence
(DNI) cited supply chain security as a major threat in the
Worldwide Threat Assessment; and the Government
Accountability Office (GAO) studied the issue.
This InFocus reviews cyber supply chain risks, discusses
ways in which they are currently managed, and provides
issues that Congress may consider.
