New GAO Report on Managing Supply Chain Risks

The Government Accountability Office (GAO) this week released an important new report entitled “GAO-21-171 Information Technology: Federal Agencies Need to Take Urgent Action to Manage Supply Chain Risks.”

According to the GAO “Federal agencies rely on information and communications technology (ICT) products and services to carry out their operations. The global supply chain for this technology faces threats, including from intelligence services and others who may seek to steal intellectual property, compromise integrity of the systems, and more. We identified 7 practices for providing an agency-wide approach to managing these supply chain risks…. The foundational practices comprising ICT SCRM are:

• establishing executive oversight of ICT activities, including designating responsibility for leading agency-wide SCRM activities;
• developing an agency-wide ICT SCRM strategy for providing the organizational context in which risk-based decisions will be made;
• establishing an approach to identify and document agency ICT supply chain(s);
• establishing a process to conduct agency-wide assessments of ICT supply chain risks that identify, aggregate, and prioritize ICT supply chain risks that are present across the organization;
• establishing a process to conduct a SCRM review of a potential supplier that may include reviews of the processes used by suppliers to design, develop, test, implement, verify, deliver, and support ICT products and services;
• developing organizational ICT SCRM requirements for suppliers to ensure that suppliers are adequately addressing risks associated with ICT products and services; and
• developing organizational procedures to detect counterfeit and compromised ICT products prior to their deployment.

The GAO went on to advise that “…in the sensitive report, GAO made a total of 145 recommendations to the 23 agencies to fully implement foundational practices in their organization-wide approaches to ICT SCRM….These recommendations called for agencies to designate responsibility for leading agency-wide SCRM activities and define SCRM roles and responsibilities for senior leaders who participate in supply chain activities; develop an agency-wide ICT SCRM strategy that makes explicit the agency’s risk tolerance and identifies how the agency intends to assess, respond to, and monitor ICT supply chain risks across the life cycle of ICT products and services; establish an approach to identify and document agency ICT supply chain(s); establish a process to conduct agency-wide assessments of ICT supply chain risks; establish a process to conduct a SCRM review of a potential supplier prior to awarding a contract or issuing an order to that supplier for ICT products and services; develop organizational ICT SCRM requirements for inclusion in contracts that are tailored to the type of contract and business needs; and develop organizational procedures to detect counterfeit and compromised ICT products prior to their deployment.”

In addition to posts on counterfeit parts prevention and diminishing manufacturing sources and material shortages (DMSMS), just a few recent DAU LOG Blog posts on this important topic include:

• New GAO Report on Managing Supply Chain Risks (12/17/2020)
• New GAO Report on Mitigating a Key Supply Chain Risk (7/27/2020)
• DAU Supply Chain Risk Management (SCRM) Resources (7/16/2020)
• Trifecta of Product Support Improvement Opportunities (4/6/2020)
• Supply Chain Risk Management (SCRM) Learning Assets (11/16/2018)
• Supply Chain Risk Management (SCRM) Report (8/15/2018)
• Supply Chain Management Risks (8/3/2018)
• Insights into DoD Supply Chain Risks (7/16/2018)
• Supply Chain Risk Management (SCRM) and Supply Chain Management (SCM) Resources (1/30/2018)
• Managing Supply Chain Risks (9/28/2017)
• Supply Chain Risk Management Article in Latest Issue of Defense AT&L Magazine (4/10/2017)