The text of the Supply Chain Risk Management Strategy and Implementation Plan
Approval #
The Chief Information Security Officer (CISO) issues this strategy. The Senior Accountable Official for Risk Management approves it, as the Program Management Policy requires.
| Role | Name | Signature |
|---|---|---|
| Chief Information Security Officer (CISO) | ||
| Senior Accountable Official for Risk Management |
Revision History #
| Date | Version | Description | Reviewer |
|---|---|---|---|
| 2026-10-31 | 1.0 | Initial issuance | [Reviewer name] |
Review cycle: Every year, and within 60 days after a new Federal Acquisition Supply Chain Security Act (FASCSA) order, prohibition, or change to National Institute of Standards and Technology (NIST) SP 800-161 that affects it.
Mandate. The Federal Acquisition Supply Chain Security Act makes the head of each executive agency responsible for supply chain risk. The Act includes “developing an overall supply chain risk management strategy and implementation plan” (41 U.S.C. § 1326(b)(1)). NIST SP 800-53 Rev. 5 control PM-30 requires an organization-wide strategy. Controls SR-2 and SR-3 require supply chain risk management plans and processes. This document is that strategy and implementation plan. It follows the outline in NIST SP 800-161 Rev. 1, Appendix D.
The CISO owns this strategy, and the Senior Accountable Official for Risk Management approves it. The Supply Chain Risk Management Policy (POL-SR) and Supply Chain Risk Management Procedures (PROC-SR) hold the control rules and the steps for supply chain events and pre-award reviews. This strategy gives the direction, the governance, and the plan for the program. The CISO runs the program through a Supply Chain Risk Management (SCRM) Council and an SCRM Team.
1. Purpose and Scope #
The Organization manages supply chain risk to:
- Keep products, services, and suppliers that put its missions at risk out of its systems.
- Find and remove covered articles quickly when a federal order or prohibition names them.
- Spend its review effort on the suppliers its missions depend on most.
- Meet the federal rules for supply chain risk, and show the Inspector General that it meets them.
This strategy covers every information and communications technology (ICT) product and service the Organization buys, leases, licenses, or uses. That includes hardware, software, firmware, cloud services, IT services, Internet of Things (IoT) devices, and operational technology (OT). It covers contracts under the Federal Acquisition Regulation (FAR), orders under other agencies’ contracts, interagency agreements, and government purchase card buys. It also covers systems that contractors run for the Organization.
In an interagency acquisition, the agency whose funds pay for the item assesses the supply chain risk. In an assisted acquisition, the interagency agreement says which agency assesses it (41 U.S.C. § 1326(c)).
2. Requirements This Strategy Meets #
| Federal requirement | Where this strategy meets it |
|---|---|
| Assess supply chain risk and set priorities by the criticality of the mission, system, component, or service (41 U.S.C. § 1326(a)) | Supplier criticality tiers; assessments before and after award |
| Develop an overall supply chain risk management strategy and implementation plan (41 U.S.C. § 1326(b)(1)) | This document, and its implementation plan |
| Build supply chain practices into the whole life cycle (41 U.S.C. § 1326(b)(2)) | Assessments before and after award; counterfeit and tamper handling |
| Share relevant supply chain risk information (41 U.S.C. § 1326(b)(4); 41 CFR 201-1.201) | Sharing supply chain risk information |
| Report progress and effectiveness (41 U.S.C. § 1326(b)(5)) | Measures and reporting |
| Comply with exclusion and removal orders (41 CFR 201-1.304; FAR 4.2303) | Responding to FASCSA orders |
| Exclude DeepSeek products, and remove them and third-party products built using DeepSeek (FASCSA Exclusion and Removal Order 2026-01) | Prohibited sources; Responding to FASCSA orders |
| Exclude products that Acronis AG and its affiliates supply, and remove them within 180 calendar days of the order’s issuance (FASCSA Exclusion and Removal Order 2026-02) | Prohibited sources; Responding to FASCSA orders |
| Exclude a source only after the statute’s steps (41 U.S.C. § 4713) | Governance; the Supply Chain Risk Management Procedures |
| Keep out prohibited sources (FAR 52.204-23; FAR 52.204-25; FAR 52.204-27; 15 CFR Part 791) | Prohibited sources |
| Keep a software and hardware inventory and match assurance to risk (OMB M-26-05) | Supplier criticality tiers; the Software and Hardware Assurance Policy |
| Organization-wide strategy, supply chain plans, and supply chain processes (NIST SP 800-53 PM-30, SR-2, SR-3) | The whole document |
3. Strategic Objectives #
The CISO and the SCRM Council work toward four objectives:
- Govern supply chain risk as one program. One council, one lead, and one set of tiers apply across every office that buys ICT.
- Know the supply chain. The Organization keeps a complete inventory of software and hardware, a critical supplier list, and a criticality tier for each supplier.
- Act on risk before and after award. Each IT purchase gets a review that matches its tier, and Tier 1 suppliers stay under watch for the life of the contract.
- Respond and share. Staff act on orders, prohibitions, and events within set times, and the CISO shares what the Organization learns with the Federal Acquisition Security Council (FASC) and other agencies.
4. Governance #
4.1 Who does what #
| Role | Responsibilities |
|---|---|
| Agency Head | Answers for supply chain risk under 41 U.S.C. 1326(a). Decides each exclusion under 41 U.S.C. 4713 in writing, after the joint recommendation and in consultation with the CISO. Requests exceptions to FASCSA orders from the issuing official. |
| Senior Accountable Official for Risk Management | Approves this strategy. Chairs the SCRM Council. Decides on Tier 1 residual risk above the tolerance in the Risk Management Strategy. |
| Chief Information Officer (CIO) | Approves IT acquisitions under the IT Governance and Investment Management Policy. Makes the joint recommendation under 41 U.S.C. 4713 with the Chief Acquisition Officer. Removes covered articles from Organization systems when an order requires it. |
| CISO | Owns this strategy and the SCRM program. Names the SCRM Lead and leads the SCRM Team. Records the supply chain review for each IT purchase. Shares supply chain risk information with the FASC. Reports the measures in this strategy. |
| Chief Acquisition Officer | Makes the joint recommendation under 41 U.S.C. 4713 with the CIO. Sits on the SCRM Council. |
| Senior Procurement Executive | Issues acquisition instructions that carry this strategy into solicitations and contracts. Makes sure Contracting Officers apply FASCSA orders and the prohibited-source clauses. Tells purchase cardholders about new orders. |
| SCRM Council | Advises the Senior Accountable Official for Risk Management. Reviews Tier 1 risks, escalated events, exclusion proposals, and progress on the implementation plan. Members: the CIO, CISO, Chief Acquisition Officer, Senior Procurement Executive, General Counsel, and the heads of the main program offices. |
| SCRM Lead | Runs the SCRM Team day to day. Serves as the point of contact for FASCSA orders and for requests from the FASC, unless the Agency Head names another official. Keeps the critical supplier list. |
| SCRM Team | Members from the CISO’s staff, acquisition, the program offices, and the Office of the General Counsel, as NIST SP 800-53 SR-2(1) describes. Assesses suppliers before and after award, monitors Tier 1 suppliers, and handles supply chain events. |
| Office of the General Counsel | Reviews each exclusion, notice to a source, exception request, and information sharing decision. Advises on foreign ownership, control, or influence (FOCI) concerns. |
| Contracting Officer | Puts the required provisions and clauses in each solicitation and contract. Checks SAM.gov for exclusions and FASCSA orders before award. Awards only after the CISO’s supply chain review record exists. Sends contractor reports to the SCRM Lead. |
| Contracting Officer’s Representative | Checks that contractors meet their supply chain terms, including notification duties. Collects contractor reports and the system-level SCRM plans for contractor systems. |
| Program Office | States the requirement and its criticality. Works with the Contracting Officer to identify the FASCSA orders that apply. Funds the mitigations its acquisitions need. |
| Mission/Business Owners | Rank their mission functions by criticality. Accept supply chain risk only within the tolerance this strategy sets. |
| System Owners | Write the system-level SCRM plan in the System Security and Privacy Plan (SSPP). Remove covered articles from their systems when an order requires it. |
| Information System Security Officers (ISSOs) | Record supply chain controls in the SSPP. Record open supply chain weaknesses as plan of action and milestones (POA&M) items. |
| Government purchase cardholders | Send each IT purchase to the CISO for review before buying. Do not buy a covered article or from an excluded source. |
| All personnel | Report a suspected supply chain event to the CISO at once. |
4.2 How the SCRM Council decides #
The Senior Accountable Official for Risk Management chairs the SCRM Council. The Council meets at the frequency in the table of values the Organization sets, and the chair can call a meeting at any time. The SCRM Lead brings the Council each Tier 1 risk above tolerance, each proposed exclusion, each FASCSA order exception request, and the progress report on the implementation plan. The Council recommends, and the chair decides or forwards the matter to the Agency Head.
The CIO and the Chief Acquisition Officer make any joint recommendation to exclude a source under 41 U.S.C. 4713. The Agency Head decides in writing after the source has had 30 days to respond, unless an urgent national security interest requires faster action. The steps are in the Supply Chain Risk Management Procedures.
Evidence: the Council charter, meeting minutes, decisions, and the written determinations.
5. Risk Appetite for Suppliers #
The Risk Management Strategy sets the Organization’s risk appetite and risk tolerance. This table applies them to supply chain risk.
| Supply chain risk | Tolerance | Who decides |
|---|---|---|
| A source or covered article that a law, FASCSA order, or information and communications technology and services (ICTS) determination prohibits | None. The Organization does not buy it, and removes it by the date its rule sets. | Only the issuing official can grant an exception or waiver. |
| A component that staff confirm is counterfeit or tampered with | None. Staff remove it and report it. | The CISO handles it as a supply chain incident. |
| Tier 1 residual risk above the tolerance in the Risk Management Strategy | Not accepted at the system level | The Senior Accountable Official for Risk Management, after SCRM Council review |
| Tier 1 residual risk within the tolerance | Accepted with conditions | The Authorizing Official (AO), with the CISO’s concurrence |
| Tier 2 or Tier 3 residual risk | Accepted with conditions | The AO for the system |
The AO records each acceptance with its conditions in the governance, risk, and compliance (GRC) system. Conditions include extra monitoring, contract terms, or a date to replace the product.
6. Supplier Criticality Tiers #
The SCRM Team assigns each supplier, product, and service a criticality tier. The tier sets how deep the review goes before award and how closely the team watches the supplier after award (41 U.S.C. § 1326(a)(2); NIST SP 800-53 RA-9). Mission/Business Owners give the team the criticality of their mission functions. System Owners give the impact level of each system.
| Tier | What falls in it | Review before award | After award |
|---|---|---|---|
| Tier 1, critical | Products and services in a High-impact system or a High Value Asset (HVA). Identity, network security, endpoint security, and other tools that run with privileged access across the enterprise. Cloud platforms that host Moderate or High systems. Managed service providers with network access. | Full review, including FOCI and the supplier’s own suppliers. High assurance tier in the Software and Hardware Assurance Policy. | Monitoring at the Tier 1 frequency. Reassessment at the SR-6 frequency and at each option or renewal. Component inspection where SR-10 applies. |
| Tier 2, important | Products and services in a Moderate-impact system. Network-connected devices. Software installed across many endpoints. | Full review. Moderate assurance tier. | Reassessment at the SR-6 frequency and at each option or renewal. |
| Tier 3, routine | Products and services in a Low-impact system, and items with no network connection that store no Organization data. | Light review: exclusions, FASCSA orders, and prohibited sources. Low assurance tier. | Checks for new orders and prohibitions only. |
The SCRM Lead keeps the critical supplier list, which holds every Tier 1 supplier. The SCRM Lead reviews the list each year, as the Supply Chain Risk Management Policy requires.
7. Assessing Suppliers Before and After Award #
7.1 Before award #
The CISO reviews each IT purchase before award, including each purchase card buy. The steps for the light and full reviews are in “Supply Chain Events and Pre-Award Review” in the Supply Chain Risk Management Policy and Procedures. That process also says the Contracting Officer awards only after the CISO’s record exists. The tier sets which review applies.
Before that review, the SCRM Team does a due diligence check on the supplier and its product, following NIST SP 1326:
- The team first checks the International Trade Administration’s Consolidated Screening List and the SAM.gov exclusions. A supplier on either needs no further research before the CISO decides.
- For every supplier, the team uses public information (basic due diligence). For Tier 1 suppliers, it also uses commercial data and supply chain illumination tools (enhanced due diligence).
- The team covers five areas. They are foreign ownership, control, or influence; where the product and its parts come from; and the supplier’s resilience. The other two are the basic cyber practices of the supplier and the product, including its software bill of materials (SBOM), and the supplier’s own suppliers.
- The team confirms each finding against more than one source where it can.
- The findings feed the supplier review (NIST SP 800-53 SR-6) and the supply chain risk assessment (NIST SP 800-53 RA-3(1)).
- The SCRM Lead decides whether a record of findings is CUI. A record that brings together a supplier’s weaknesses, or holds findings from a commercial tool, is usually CUI. (NIST SP 1326)
Other documents carry the related steps:
- “Security and Privacy Contract Terms” in the System and Services Acquisition Policy and Procedures: the clauses and terms each contract needs, including notification of supply chain compromises (NIST SP 800-53 SR-8).
- The Software and Hardware Assurance Policy (POL-SWHW-001): the assurance evidence each product tier needs, and the right to request a software bill of materials (SBOM). Office of Management and Budget (OMB) M-26-05 lets the Organization choose the Secure Software Development Attestation Form and SBOM terms by risk.
- “Using Federal Risk and Authorization Management Program (FedRAMP) and FedRAMP 20x Authorized Cloud Services” in the Assessment, Authorization, and Monitoring Policy and Procedures: cloud services.
- The IT Governance and Investment Management Policy (POL-ITGOV-001): the CIO’s approval of IT acquisitions.
- The Super Intelligence (SI) Governance and Acquisition Policy (POL-AI-001): SI systems and services.
7.2 After award #
- The SCRM Team monitors each Tier 1 supplier at the set frequency. It looks for new orders, prohibitions, exclusions, ICTS determinations, ownership changes, breaches, and known exploited vulnerabilities in the supplier’s products.
- The SCRM Team reassesses Tier 1 and Tier 2 suppliers at the SR-6 frequency, and before each option or renewal (NIST SP 800-53 SR-6).
- The Contracting Officer’s Representative checks that the contractor meets its supply chain terms. The representative sends each contractor notice of a compromise to the SCRM Lead (NIST SP 800-53 SR-8).
- Each contractor-operated system has its own system-level SCRM plan, or inherits the contractor’s organization-level plan. The plan says how the contractor reports supply chain events to the Organization (NIST SP 800-161 Rev. 1).
- When a contract ends, the System Owner removes the supplier’s access and gets back or destroys Organization data (NIST SP 800-53 SR-12).
Evidence: the monitoring reviews, the reassessments, the representative’s checks, and the contractor plans.
8. System-Level SCRM Plans #
Each System Owner writes a system-level SCRM plan that follows this strategy (NIST SP 800-53 SR-2). The plan sits in the SSPP, in the supply chain risk management section, as NIST SP 800-18 Rev. 2 describes. The plan names the system’s suppliers and their tiers. It lists the SR controls the system selects and how it meets them, and records what the system inherits from the Organization. The ISSO stores the plan with the authorization package in the GRC system. The System Owner updates the plan when the system’s suppliers or tiers change. The System Owner also reviews it at the SR-2 frequency, which is every year.
Evidence: the supply chain section of each SSPP, with its review dates.
9. Prohibited Sources #
The Organization must not buy the products, services, and sources in this table. System Owners remove any already in use by the date its rule sets. That is at once for most rules, and within 180 calendar days of issuance for the Acronis order. The Contracting Officer puts the matching clauses in each solicitation and contract. The Contracting Officer also checks the offeror’s representations before award. Where the Organization has adopted a class deviation for the Revolutionary FAR Overhaul, the same rules sit in FAR Part 40. The Contracting Officer then uses the clause numbers the deviation sets.
| Prohibition | What it covers | Where the rule is |
|---|---|---|
| Section 889 | Covered telecommunications and video surveillance equipment and services from the five companies the statute names, and their subsidiaries and affiliates. The Organization must not buy them, or contract with an entity that uses them. | FAR 52.204-25, with the representations in FAR 52.204-24 and FAR 52.204-26 |
| Kaspersky Lab | Hardware, software, and services that Kaspersky Lab covered entities develop or provide. | FAR 52.204-23; Cybersecurity and Infrastructure Security Agency (CISA) Binding Operational Directive (BOD) 17-01; the 2024 ICTS final determination under 15 CFR Part 791 |
| ByteDance covered applications | TikTok, or a successor application or service, that ByteDance Limited or an entity it controls develops or provides, on Organization IT and on IT contractors use for the contract. The Software and Hardware Assurance Policy explains which TikTok app is no longer covered. | FAR 52.204-27 |
| FASCSA orders | Each source or covered article that an exclusion or removal order names. | FAR 52.204-29 and FAR 52.204-30; 41 CFR Part 201-1; SAM.gov |
| DeepSeek | Products and services from DeepSeek and its affiliates, and third-party products and services built using DeepSeek implementations. | FASCSA Exclusion and Removal Order 2026-01 |
| Acronis | Covered articles that Acronis AG or its affiliates supply, directly or indirectly. Acronis sells data backup, data protection, file sharing, and disaster recovery products, on premises and in the cloud. | FASCSA Exclusion and Removal Order 2026-02 |
| Unmanned aircraft systems | Unmanned aircraft systems from American Security Drone Act covered foreign entities. | FAR 52.240-1; the Unmanned Aircraft Systems Security Procedure |
| ICTS determinations | Transactions prohibited after a federal review of information and communications technology and services (ICTS) supply chain risk. | 15 CFR Part 791; Executive Order (EO) 13873 |
| Exclusions in SAM.gov | Suspended, debarred, and proposed-for-debarment sources. | FAR subpart 9.4 |
When a contractor reports covered telecommunications equipment, it must report within one business day, and add mitigation details within 10 business days (FAR 52.204-25(d)). The Contracting Officer sends each report to the SCRM Lead, who handles it as a supply chain event. The SCRM Lead tracks proposed rules, such as the proposed FAR rule that would bar certain semiconductor products and services. The CISO adds a prohibition to this table when its rule is final.
10. Responding to FASCSA Orders #
Compliance with an exclusion or removal order is mandatory (41 CFR 201-1.304(a)). Executive agencies must not buy or obtain a covered article or source that an applicable order prohibits (FAR 4.2303). These steps run each time a new order applies to the Organization. CISA recommends the same steps in FASCSA Order Preparation for the FCEB.
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| SCRM Lead | Checks SAM.gov for new FASCSA orders at the set frequency, and when CISA or the FASC announces an order. Records each order that applies. | SAM.gov, the GRC system | Order record with its date | SR-03 |
| SCRM Lead | Searches the inventories for each covered article and source, including contractor systems, embedded components, and third-party products built on a covered source. | The asset inventory tool, the ticketing system | List of affected assets and contracts | CM-08, SR-03 |
| System Owner | Removes covered articles by the date the removal order sets, or at once when the order says so. Isolates them and adds logging until removal. | The ticketing system | Change tickets | SR-03, CM-03 |
| Contracting Officer | Updates affected solicitations. Modifies affected contracts within 6 months, or records in the contract file why not, as FAR 4.2304(c) describes. | Contract file | Amendments and modifications | SA-04 |
| Senior Procurement Executive | Tells Contracting Officers and purchase cardholders about the order. | The document management system | Notice and distribution list | SR-05 |
| Contracting Officer’s Representative | Collects the contractor reports that FAR 52.204-30(c) requires, and sends them to the SCRM Lead. | Contract file | Contractor reports | SR-08 |
| Office of the General Counsel | Reviews any request for an exception before the Agency Head sends it to the issuing official under 41 CFR 201-1.304(b), within the time the order sets. | The document management system | Legal review and request | SR-03 |
| CISO | Reports compliance as the order and OMB require, and records the result. | CyberScope, the GRC system | Compliance report | PM-30 |
Evidence: the order records, the search results, the change tickets, the contract modifications, the contractor reports, and the compliance report.
10.1 Orders in force #
The SCRM Lead keeps this list current from SAM.gov and records each order’s scope.
- DeepSeek. The Secretary of Homeland Security issued FASCSA Exclusion and Removal Order 2026-01 with an original release date of July 24, 2026. The Department of Homeland Security published notice of it in the Federal Register on October 20, 2026 (FASCSA Exclusion and Removal Order 2026-01). It applies to civilian agencies, except their national security systems and sensitive compartmented information (SCI) systems.
- Staff must not buy DeepSeek products or services, or those of DeepSeek’s affiliates. The ban covers approved products lists, service provider equipment lists, and e-commerce markets.
- System Owners must remove those products at once. They must also remove third-party products and services built using DeepSeek implementations.
- The Agency Head may ask the issuing official for an exception in writing within 60 days of the order’s issuance.
- Until removal is complete, the CISO watches network traffic and adds logging and data exfiltration controls on the affected systems, as the order encourages.
- Acronis. The Secretary of Homeland Security issued FASCSA Exclusion and Removal Order 2026-02 with an original release date of July 31, 2026. The Department of Homeland Security published notice of it in the Federal Register on October 30, 2026 (FASCSA Exclusion and Removal Order 2026-02). It applies to civilian agencies, except their national security systems and SCI systems. It also covers systems that contractors run for the Organization.
- Staff must not buy products or services that Acronis AG or its affiliates supply, directly or indirectly. The ban covers approved products lists, service provider equipment lists, and e-commerce markets.
- System Owners must remove those products within 180 calendar days of the order’s issuance, unless the Organization gets an exception.
- The Agency Head may ask the issuing official for an exception in writing within 60 days of the order’s issuance. The request goes to FASCSA.Orders@cisa.dhs.gov.
- The order says that Acronis cybersecurity and backup tools have privileged or root access to the systems they protect. The SCRM Lead includes backup, disaster recovery, and file sharing tools in the inventory search.
- Until removal is complete, the CISO watches network traffic and adds logging and data exfiltration controls on the affected systems, as the order encourages.
- Acronis, intelligence community order. The Director of National Intelligence issued a 2025 FASCSA order on Acronis. Such an order covers the intelligence community and SCI systems only (41 U.S.C. § 1323). It does not bind the Organization’s other systems. The 2026 order from the Secretary of Homeland Security is the one that binds them. The SCRM Lead checks whether the Organization runs an SCI system or buys for one.
11. Counterfeit and Tampered Components #
- Staff buy hardware from the original manufacturer or its authorized resellers. The Contracting Officer records the reason for any other source (NIST SP 800-53 SR-11).
- Staff who receive or install components check them for signs of counterfeiting or tampering. They inspect the systems and components in the component inspection value (NIST SP 800-53 SR-10).
- Staff report a suspected counterfeit or tampered component to the CISO at once. The CISO handles it under “Supply Chain Events and Pre-Award Review”, and reports a confirmed counterfeit as the counterfeit reporting value says (NIST SP 800-53 SR-11).
- The people in the anti-counterfeit training value complete that training each year (NIST SP 800-53 SR-11(1)).
- System Owners keep configuration control over components sent out for service or repair and over components that come back (NIST SP 800-53 SR-11(2)).
Evidence: the purchase records, inspection records, event records, and training records.
12. Sharing Supply Chain Risk Information #
Executive agencies must send supply chain risk information to the FASC when the FASC asks for it. They must also send it when they find a reasonable basis to conclude that a substantial supply chain risk exists (41 CFR 201-1.201(b); FAR 4.2302).
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| SCRM Lead | Sends supply chain risk information to the FASC’s information sharing agency when the FASC asks for it. | The document management system | Submission record | SR-08 |
| CISO | Decides whether a substantial supply chain risk exists for a source or covered article. If it does, sends the information to the FASC without delay. | The GRC system | Decision and submission record | SR-06, SR-08 |
| Office of the General Counsel | Checks markings and handling rules before classified or controlled unclassified information leaves the Organization. | The document management system | Legal review | SR-08 |
| SCRM Team | Receives threat information from CISA, the FASC, and the information sharing and analysis centers (ISACs) the Organization belongs to, and checks it against the inventories. | The GRC system | Threat review notes | PM-16, SR-06 |
Evidence: the submission records, the legal reviews, and the threat review notes.
13. Measures and Reporting #
The CISO reports these measures to the SCRM Council at each meeting, and to the CIO and the Senior Accountable Official for Risk Management each quarter (41 U.S.C. § 1326(b)(5)). The same records answer the Cybersecurity Supply Chain Risk Management questions in the IG FISMA metrics (FY 2025 IG FISMA Metrics and Evaluation Guide).
| Measure | Target |
|---|---|
| IT purchases with a recorded supply chain review before award, including purchase card buys | 100 percent |
| Tier 1 suppliers assessed within the SR-6 frequency | 100 percent |
| Tier 1 suppliers under monitoring | 100 percent |
| New FASCSA orders checked against the inventories within 3 business days | 100 percent |
| Covered articles removed by the date each order sets | 100 percent |
| Systems with a current system-level SCRM plan | 100 percent |
| Supply chain events with a recorded decision within 5 business days | At least 95 percent |
14. Implementation Plan #
The CISO tracks each milestone in this table and reports its status to the SCRM Council. A milestone owner who expects to miss a date tells the CISO, who brings the change to the Council.
| Milestone | Owner | Priority | Target date | Status |
|---|---|---|---|---|
| Charter the SCRM Council and name the SCRM Lead and SCRM Team | CISO | Do now | [Date] | [Planned, in progress, or complete] |
| Set the values in the table of values the Organization sets | CISO | Do now | [Date] | [Status] |
| Assign a criticality tier to each current supplier and contract | SCRM Team | Do now | [Date] | [Status] |
| Publish the critical supplier list | SCRM Lead | Do now | [Date] | [Status] |
| Add the supply chain terms to the contract templates | Senior Procurement Executive | Do now | [Date] | [Status] |
| Start monitoring every Tier 1 supplier | SCRM Team | Do next | [Date] | [Status] |
| Write or confirm a system-level SCRM plan for every system | System Owners | Do next | [Date] | [Status] |
| Train the people named in the anti-counterfeit value | CISO | Do next | [Date] | [Status] |
| Exercise the FASCSA order response with a mock order | SCRM Lead | Do next | [Date] | [Status] |
| Report the measures in this strategy for a full year | CISO | Do later | [Date] | [Status] |
| Review this strategy against a year of results | CISO | Do later | [Date] | [Status] |
15. Values the Organization Sets #
The CISO proposes these values and the SCRM Council agrees them. The values print here once the Organization sets them.
| Value | Setting | What it controls |
|---|---|---|
| Council meetings | [Assignment: organization-defined Supply Chain Risk Management Council meeting frequency — to be defined] | How often the Supply Chain Risk Management Council meets to review risks, escalations, and progress. |
| FASCSA order check | [Assignment: organization-defined frequency for checking SAM.gov for new FASCSA orders, at least quarterly — to be defined] | How often the Supply Chain Risk Management Lead checks SAM.gov for new orders. The Software and Hardware Assurance Policy sets the floor. |
| Tier 1 supplier monitoring | [Assignment: organization-defined frequency for monitoring Tier 1 suppliers — to be defined] | How often the Supply Chain Risk Management Team reviews monitoring results for each Tier 1 supplier. |
| Supplier reassessment | [SR-06 parameter 1 — to be defined] | How often the team reassesses Tier 1 and Tier 2 suppliers (NIST SP 800-53 SR-6). |
| Strategy review | [PM-30 parameter 1 — to be defined] | How often the CISO reviews and updates this strategy (NIST SP 800-53 PM-30). |
| Anti-counterfeit training | [SR-11(1) parameter 1 — to be defined] | Who completes the anti-counterfeit training (NIST SP 800-53 SR-11(1)). |
| Counterfeit reporting | [SR-11 parameter 1 — to be defined] | Who receives reports of counterfeit components (NIST SP 800-53 SR-11). |
| Component inspection | [SR-10 parameter 1 — to be defined] | Which systems or components staff inspect for tampering (NIST SP 800-53 SR-10). |
16. Review and Update #
The CISO reviews this strategy at the frequency in the table of values and every year. The CISO also reviews it within 60 days after a change that affects it. Examples are a new FASCSA order or prohibition, a change to NIST SP 800-161, a major supply chain incident, or a change in the Organization’s missions. NIST SP 800-161 Rev. 1 calls for a full revision every 3 to 5 years at least. The review record goes in the policy library in the document management system.
17. Definitions #
- Supply chain event: a sign that a product, service, or supplier may put the Organization at risk, as the Supply Chain Risk Management Policy defines it.
- Covered article: information technology, telecommunications equipment or services, and the other items 41 CFR 201-1.101 lists.
- FASCSA order: an exclusion or removal order issued under the Federal Acquisition Supply Chain Security Act, as FAR 52.204-30 defines it.
- Critical supplier: a supplier in Tier 1.
18. Related Documents #
- Supply Chain Risk Management Policy (POL-SR) and Supply Chain Risk Management Procedures (PROC-SR): “Supply Chain Events and Pre-Award Review”.
- Risk Management Strategy: the Organization’s risk appetite and risk tolerance.
- Software and Hardware Assurance Policy (POL-SWHW-001): product assurance tiers and SBOM terms.
- System and Services Acquisition Policy (POL-SA) and Procedures (PROC-SA): “Security and Privacy Contract Terms”.
- IT Governance and Investment Management Policy (POL-ITGOV-001) and IT Asset Management Policy (POL-ITAM-001).
- Unmanned Aircraft Systems Security Procedure (PROC-UAS-001).
- Incident Response Plan (PLAN-IR-001): supply chain incidents.
19. Derived Governance Requirements #
- Develop an overall supply chain risk management strategy and implementation plan, with the policies and processes that guide and govern supply chain risk management. (41 U.S.C. § 1326(b)(1))
- Build supply chain risk management practices into the whole life cycle of each system, component, service, or asset. (41 U.S.C. § 1326(b)(2))
- Report on the progress and effectiveness of supply chain risk management as OMB and the Federal Acquisition Security Council direct. (41 U.S.C. § 1326(b)(5))
- In an interagency acquisition, assess the supply chain risk when the Organization’s funds pay for the covered article; in an assisted acquisition, settle in the interagency agreement which agency assesses it. (41 U.S.C. § 1326(c))
- Exclude a source under 41 U.S.C. 4713 only after the joint recommendation of the chief acquisition officer and the CIO, notice to the source, and a written determination made in consultation with the CISO. (41 U.S.C. § 4713(b))
- Comply with each exclusion and removal order that applies to the Organization, and with the handling restrictions the issuing official places on it. (41 CFR 201-1.304(a))
- Send supply chain risk information to the FASC without delay when the FASC asks for it, or when the Organization finds a reasonable basis to conclude that a substantial supply chain risk exists. (41 CFR 201-1.201(b))
The other federal supply chain requirements, including each prohibition in the table of prohibited sources, are in the Derived Governance Requirements of the Supply Chain Risk Management Policy.
20. References #
These are the sources this document cites, with a link to each official text.
- 15 CFR Part 791: Securing the Information and Communications Technology and Services Supply Chain, July 18, 2024.
- 41 CFR Part 201-1: Federal Acquisition Security Council (FASC) — Rules and Procedures, August 26, 2021.
- Exclusion and Removal of Acronis Products and Services from Federal Civilian Executive Branch Information Technology Systems, July 31, 2026.
- Exclusion and Removal of DeepSeek Products and Services from Federal Civilian Executive Branch Information Technology Systems, July 24, 2026.
- FAR 52.204-23: Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab Covered Entities, July 16, 2018.
- FAR 52.204-25: Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment (Section 889; with FAR 52.204-24 and 52.204-26 representations), August 13, 2020.
- FAR 52.204-27: Prohibition on a ByteDance Covered Application, June 2, 2023.
- FAR 52.204-30: Federal Acquisition Supply Chain Security Act Orders — Prohibition (with FAR 52.204-29 representation and disclosures), December 4, 2023.
- FAR Part 40: Information Security and Supply Chain Security, April 1, 2024.
- FASCSA Order Preparation for the FCEB, November 29, 2024.
- Federal Acquisition Regulation (FAR), current text.
- FedRAMP Consolidated Rules for 2026 (including 20x Key Security Indicators), June 24, 2026.
- Functions and authorities of the Federal Acquisition Security Council (41 U.S.C. § 1323), December 21, 2018.
- FY 2025 IG FISMA Metrics and Evaluation Guide, January 1, 2025.
- NIST SP 800-18 Rev. 2: Developing System Plans (system security plans, system privacy plans, C-SCRM plans), June 30, 2026.
- NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
- NIST SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, November 1, 2024.
- NIST SP 1326: NIST Cybersecurity Supply Chain Risk Management: Due Diligence Assessment Quick-Start Guide, July 8, 2026.
- OMB M-26-05: Adopting a Risk-based Approach to Software and Hardware Security, January 23, 2026.
- Requirements for executive agencies (Federal Acquisition Supply Chain Security Act) (41 U.S.C. § 1326), December 21, 2018.
- Strengthening and Enhancing Cyber-capabilities by Utilizing Risk Exposure Technology Act (SECURE Technology Act) — Federal Acquisition Security Council (Pub. L. 115-390, Title II; 41 U.S.C. §§ 1321–1328; 41 U.S.C. § 4713), December 21, 2018.