Information and Communications Technology Supply Chain Security

Information and communications technology (ICT) is integral for the daily operations and functionality of U.S. critical infrastructure. The ICT supply chain is a complex, globally interconnected ecosystem that encompasses the entire life cycle of ICT hardware, software, and managed services and a wide range of entities including third-party vendors, suppliers, service providers, and contractors. If vulnerabilities within the supply chain are exploited, the consequences can affect all users of that technology or service.

Compounding the complexity of securing the supply chain is that vulnerabilities may be introduced during any phase of the product life cycle: design, development and production, distribution, acquisition and deployment, maintenance, and disposal. These vulnerabilities can include the incorporation of malicious software, hardware, or counterfeit components, flawed product designs, or poor manufacturing processes and maintenance procedures. 

CISA works with government and industry partners to ensure that supply chain risk management (SCRM) is an integrated component of security and resilience planning for the nation’s infrastructure. From cell phone devices to information-sharing software, government and industry purchase ICT products and services and use them to power and enable critical infrastructure systems. However, a supply chain is only as strong as its weakest link. Foreign adversaries, hackers, and criminals seeking to steal, compromise or alter, or destroy sensitive information can target government and industry via the contractors, sub-contractors, and suppliers at all tiers of the ICT supply chain. 

In December 2018, the Department of Homeland Security established the ICT Supply Chain Risk Management (SCRM) Task Force. Co-chaired by CISA and the Information Technology and Communications Sector Coordinating Councils, the Task Force is a public-private partnership charged to identify and develop consensus risk management strategies to enhance global ICT supply chain security. It serves as the Agency’s center of gravity for supply chain risk management partnership activity.