Supply Chain Risk Management Policy

Approval #

Revision History #

Review cycle: Every year, under the Policy and Procedure Management Policy.

1. Purpose and Scope #

In this policy, the CISO sets the Organization’s requirements for supply chain risk management in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:

• The Federal Information Security Modernization Act (FISMA) of 2014.
• National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 5.
• Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource.
• The OMB memoranda and Executive Orders that apply.

The Organization also uses this policy to carry out the NIST Cybersecurity Framework (CSF) 2.0, which Executive Order 13800 and OMB Circular A-130 require.

1.1 Program Objectives #

This policy covers supply chain risk management. The Organization cannot control its supply chain, so it must manage the risk that comes from it. The Organization must run cybersecurity supply chain risk management (C-SCRM) under NIST SP 800-161 and Federal Acquisition Supply Chain Security Act (FASCSA). That means a supply chain risk management plan and team, and supplier assessments before and during performance. It also means component transparency through software bill of materialss (SBOMs) that meet the Cybersecurity and Infrastructure Security Agency (CISA) 2026 minimum elements. It must set provenance and integrity requirements for acquired components. It must write agreements that flow security obligations down to subcontractors, and it must dispose of components in a way that prevents data and component leakage.

This policy applies to everyone in the program: executives who accept risk, System Owners who fund the controls, security officers who run them, and every user. By following it, the Organization meets its FISMA obligations for this control family and shows its maturity in the annual Inspector General (IG) FISMA evaluation. The Organization’s target is Level 4 (Managed and Measurable). The CISO tracks progress with the performance measures and the improvement commitments later in this policy.

1.2 CSF 2.0 Alignment #

The controls in this policy support these CSF 2.0 categories:

• GV.RM — Risk Management Strategy (Govern function)
• GV.SC — Cybersecurity Supply Chain Risk Management (Govern function)

These categories fall under the Govern function(s) of CSF 2.0. The Organization’s CSF 2.0 Profile maps each category to the NIST SP 800-53 controls in this policy.

This policy covers every supply chain risk management control in the low baseline of FIPS 200 and NIST SP 800-53B:

• SR-01 — Policy and Procedures
• SR-02 — Supply Chain Risk Management Plan
• SR-02(1) — Establish SCRM Team
• SR-03 — Supply Chain Controls and Processes
• SR-05 — Acquisition Strategies, Tools, and Methods
• SR-08 — Notification Agreements
• SR-10 — Inspection of Systems or Components
• SR-11 — Component Authenticity
• SR-11(1) — Anti-counterfeit Training
• SR-11(2) — Configuration Control for Component Service and Repair
• SR-12 — Component Disposal

2. Authority and References #

The CISO issues this policy under the authority of:

• FISMA 2014 (44 U.S.C. § 3551 et seq.) — Statutory mandate for federal information security programs
• NIST SP 800-53 Rev 5 — Security and Privacy Controls for Information Systems and Organizations
• OMB Circular A-130 — Managing Information as a Strategic Resource
• OMB Circular A-123 — Management’s Responsibility for Internal Control (revised March 10, 2026)
• NIST CSF 2.0 — Cybersecurity Framework (mandated by EO 13800 and OMB Circular A-130)
• EO 13800 — Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure
• OMB M-26-05: Adopting a Risk-based Approach to Software and Hardware Security, January 23, 2026.
• NIST SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, November 1, 2024.
• NIST SP 800-218: Secure Software Development Framework (SSDF), February 2022.
• FAR 52.204-30: Federal Acquisition Supply Chain Security Act Orders — Prohibition (with FAR 52.204-29 representation and disclosures), December 4, 2023.
• Exclusion and Removal of DeepSeek Products and Services from Federal Civilian Executive Branch Information Technology Systems, July 24, 2026.
• Exclusion and Removal of Acronis Products and Services from Federal Civilian Executive Branch Information Technology Systems, July 31, 2026.
• FAR 52.204-25: Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment (Section 889; with FAR 52.204-24 and 52.204-26 representations), August 13, 2020.
• FAR 52.204-23: Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab Covered Entities, July 16, 2018.
• FAR 52.204-27: Prohibition on a ByteDance Covered Application, June 2, 2023.
• Executive Order 13873: Securing the Information and Communications Technology and Services Supply Chain, May 15, 2019.

2.1 Derived Governance Requirements #

The requirements below come from federal governance sources and apply to the SR control family. They add to the NIST SP 800-53 control requirements in the Policy section.

Executive Order 14028: Improving the Nation’s Cybersecurity

• The organization must secure the software supply chain through secure development practices, a software inventory, and producer assurance evidence matched to product risk, as OMB M-26-05 directs. (EO 14028, §4; OMB M-26-05)

CISA/NSA/FBI 2026 Minimum Elements for a Software Bill of Materials (SBOM)

• The organization must require software suppliers to provide SBOMs that satisfy the 2026 SBOM Minimum Elements, including the required data fields (component name, version, supplier, unique identifiers, component hash, dependency relationships, SBOM author, timestamp) so component provenance and supply chain risk can be evaluated. (CISA 2026 SBOM Minimum Elements, Data Fields)
• The organization must address SBOM practices and processes explicitly in any policy, contract, or arrangement to request or provide SBOMs — including frequency of SBOM updates, depth of dependency coverage, handling of known-unknowns, and distribution and access expectations. (CISA 2026 SBOM Minimum Elements, Practices and Processes)

OMB M-26-05: Adopting a Risk-based Approach to Software and Hardware Security

• The organization must decide the assurance evidence required of a producer by the risk of the product and its use — for example secure development evidence aligned to NIST SP 800-218, and a software bill of materials on request (for cloud platforms, an SBOM of the runtime production environment) — and record the assurance determination with the inventory entry. (OMB M-26-05, footnote 1 and referenced resources)

NIST SP 800-161 Rev 1: Cybersecurity Supply Chain Risk Management Practices

• The organization must operate a cybersecurity supply chain risk management program that identifies, assesses, and mitigates supplier and product risk across the acquisition lifecycle, with C-SCRM plans at the enterprise, mission, and system levels. (NIST SP 800-161 Rev 1)

FAR 52.204-30: Federal Acquisition Supply Chain Security Act Orders — Prohibition

• The organization must apply Federal Acquisition Security Council exclusion and removal orders as written: do not acquire or use a covered article an order names; require contractors, through Federal Acquisition Regulation (FAR) clause 52.204-30, to check the System for Award Management (SAM) FASCSA order list at SAM.gov at least every 3 months, to report within 3 business days of identifying a covered article subject to an order, and to submit a removal report within 10 business days; and reconcile each new order against the organization’s own software and hardware inventory. Deadline: Contractor SAM.gov check at least every 3 months; report within 3 business days and removal report within 10 business days of an order. (FAR 52.204-30; FAR 52.204-29; 41 CFR Part 201-1)

FAR 52.204-25: Prohibition on Certain Telecommunications and Video Surveillance Services or Equipment (Section 889)

• The organization must exclude covered telecommunications and video surveillance equipment and services from Huawei, ZTE, Hytera, Hikvision, Dahua, and their subsidiaries and affiliates from every procurement, contract extension, and renewal, and from use as a substantial or essential component of any system; obtain the FAR 52.204-24 and 52.204-26 representations before award and keep them in the contract file. (FAR 52.204-25; FY2019 NDAA § 889)

FAR 52.204-23: Prohibition on Kaspersky Lab Covered Entities

• The organization must exclude hardware, software, and services developed or provided by Kaspersky Lab covered entities from acquisition and use, and remove any found in the inventory; the prohibition rests on FAR 52.204-23, CISA BOD 17-01, and the ICTS final determination under 15 CFR Part 791 that barred the products for U.S. persons from 2024-09-29. (FAR 52.204-23; BOD 17-01; 15 CFR Part 791)

FAR 52.204-27: Prohibition on a ByteDance Covered Application

• The organization must prohibit the presence or use of any application or service that ByteDance Limited, or an entity in which ByteDance holds a controlling ownership stake, develops or provides, on information technology the organization owns or that contractors use in performance of its contracts, except under an exception the law authorizes; enforce the prohibition through device management. Contracting Officers include FAR 52.204-27 in solicitations and contracts as the FAR requires. The TikTok app run by the TikTok U.S. Data Security Joint Venture is no longer a covered application. (FAR 52.204-27; Consolidated Appropriations Act, 2023, Div. R § 102; Department of Justice Office of Legal Counsel opinion (July 16, 2026))

SECURE Technology Act: Strengthening and Enhancing Cyber-capabilities by Utilizing Risk Exposure Technology Act (SECURE Technology Act) — Federal Acquisition Security Council

• The organization must assess supply chain risks, prioritizing by the criticality of the mission, system, component, or service, and avoid, mitigate, accept, or transfer each risk. (41 U.S.C. § 1326(a))
• The organization must share relevant supply chain risk information with the Federal Acquisition Security Council as the Council’s rules require. (41 U.S.C. § 1323; 41 CFR Part 201-1)
• The organization must assess supply chain risk before award for covered procurements, and exclude a source under 41 U.S.C. 4713 only with the required written determination. (41 U.S.C. § 4713; 41 U.S.C. § 1326)

FASCSA Exclusion and Removal Order 2026-01: Exclusion and Removal of DeepSeek Products and Services from Federal Civilian Executive Branch Information Technology Systems

• The organization must exclude DeepSeek, its affiliated entities, and their products from every procurement, including approved products lists, service provider equipment lists, and e-commerce markets. Deadline: Effective immediately after the order’s issuance. (FASCSA Exclusion and Removal Order 2026-01)
• The organization must remove DeepSeek products, and third-party products and services built using DeepSeek implementations, from Organization systems at once, or ask the issuing official for an exception. Deadline: Removal immediately after issuance; a written exception request within 60 days of issuance. (FASCSA Exclusion and Removal Order 2026-01)
• The organization must send any request for an exception to the order in writing within 60 days of its issuance, with the justification and the other mitigations the order lists. Deadline: 60 days after issuance. (FASCSA Exclusion and Removal Order 2026-01; 41 CFR 201-1.304(b))

FASCSA Exclusion and Removal Order 2026-02: Exclusion and Removal of Acronis Products and Services from Federal Civilian Executive Branch Information Technology Systems

• The organization must exclude products and services that Acronis AG and its affiliates supply, directly or indirectly, from every ongoing and future procurement, including approved products lists, service provider equipment lists, and e-commerce markets. Deadline: Effective immediately after the order’s issuance. (FASCSA Exclusion and Removal Order 2026-02)
• The organization must remove products and services that Acronis AG and its affiliates supply from Organization systems, including systems a contractor runs for the Organization, within 180 calendar days of the order’s issuance, or ask the issuing official for an exception. Deadline: Removal within 180 calendar days of issuance; a written exception request within 60 days of issuance. (FASCSA Exclusion and Removal Order 2026-02)
• The organization must send any request for an exception to the order in writing within 60 days of its issuance to FASCSA.Orders@cisa.dhs.gov, with the justification and the other mitigations the order lists. Deadline: 60 days after issuance. (FASCSA Exclusion and Removal Order 2026-02; 41 CFR 201-1.304(b))

NIST SP 800-160: Engineering Trustworthy Secure Systems

• The organization should integrate supply chain risk management into systems engineering, including supplier assessment, component provenance tracking, and continuous monitoring of supply chain threats throughout the system lifecycle. (NIST SP 800-160v1r1, §3.4)

15 CFR Part 791: Securing the ICTS Supply Chain (EO 13873)

• The organization should treat an information and communications technology and services (ICTS) determination under EO 13873 and 15 CFR Part 791 that names a vendor or product the organization uses as a supply-chain risk event: assess the affected systems under the C-SCRM process, record the CIO’s risk decision, and remove or replace the product where the determination prohibits its use — even when no FASCSA order exists. (15 CFR Part 791; EO 13873)

FY2023 National Defense Authorization Act (NDAA) § 5949: Prohibition on Certain Semiconductor Products and Services

• The organization may prepare to exclude covered semiconductor products and services (Semiconductor Manufacturing International Corporation (SMIC), Yangtze Memory Technologies (YMTC), ChangXin Memory Technologies (CXMT), and their affiliates) from procurement and from critical systems by the statutory date, and add the implementing FAR clause to acquisition templates when the final rule issues. Deadline: 2027-12-23. (FY2023 NDAA § 5949; FR 2026-03065 (proposed rule))

3. Policy #

The Organization must implement and maintain its supply chain risk management controls to meet the following requirements:

SR-01 — Policy and Procedures #

Baselines: Low / Moderate / High CSF 2.0: GV.RM (Risk Management Strategy), GV.SC (Cybersecurity Supply Chain Risk Management)

Requirement:

1. Develop, document, and disseminate to include chief privacy and ISSO and/or similar role or designees:

1. [Selection (one or more): organization-level; mission/business process-level; system-level — to be defined] supply chain risk management policy that:

1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and

2. Procedures to facilitate the implementation of the supply chain risk management policy and the associated supply chain risk management controls;

2. Designate an [Assignment: organization-defined official — to be defined] to manage the development, documentation, and dissemination of the supply chain risk management policy and procedures; and
3. Review and update the current supply chain risk management:

1. Policy at least every 3 years and following significant changes; and
2. Procedures at least annually and following [Assignment: organization-defined events — to be defined].

Implementation guidance:

The Organization must keep a supply chain risk management policy and the procedures that put it into practice. The policy states its purpose and scope, assigns roles, records management’s commitment, and sets expectations for coordination across the Organization and for compliance. It must stay consistent with the software supply chain protections that Executive Order (EO) 14028 directs. The CISO owns both documents. The CISO develops them, documents them, and sends each approved version to the Authorizing Official (AO), System Owners, Information System Security Officers (ISSOs), and key stakeholders. The CISO must review and update the policy and the procedures every year, and sooner after a major change to applicable policy. The CISO sets the supply chain protections once in this policy, so every acquisition uses the same protections without renegotiating them.

SR-02 — Supply Chain Risk Management Plan #

Baselines: Low / Moderate / High CSF 2.0: GV.RM (Risk Management Strategy), GV.SC (Cybersecurity Supply Chain Risk Management)

Requirement:

1. Develop a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal of the following systems, system components or system services: [Assignment: organization-defined systems, system components, or system services — to be defined];
2. Review and update the supply chain risk management plan at least annually or as required, to address threat, organizational or environmental changes; and
3. Protect the supply chain risk management plan from unauthorized disclosure and modification.

Implementation guidance:

The CISO, with support from the supply chain risk management (SCRM) team, must keep a supply chain risk management plan that covers all of the Organization’s systems, system components, and system services, including external applications. The plan must address supply chain risk from research and development through acquisition, operations, and disposal. The plan must state the Organization’s supply chain risk tolerance, its mitigation approaches, and the roles that carry them out. The CISO must review and update the plan every year, and sooner when a threat, organizational, or environmental change requires it. The SCRM team must keep a list of critical suppliers, drawn from the system inventories and acquisition spending, and review it at the same interval. Each contractor-operated system must have a system-level SCRM plan, or inherit one from the contractor’s organization-level plan, as NIST SP 800-161 Rev 1 describes. That plan must say how the contractor handles supply chain events and reports them to the Organization. The Supply Chain Risk Management Strategy and Implementation Plan (PLAN-SCRM-001) is the organization-level plan, and each System Owner records the system-level plan in the system’s System Security and Privacy Plan (SSPP). The CISO must limit access to the plan to people who need it for their work.

SR-02(1) — Establish SCRM Team #

Baselines: Low / Moderate / High

Requirement:

Establish a supply chain risk management team consisting of [Assignment: organization-defined personnel, roles and responsibilities — to be defined] to lead and support the following SCRM activities: [Assignment: organization-defined supply chain risk management activities — to be defined].

Implementation guidance:

The Organization must keep a supply chain risk management team. The team is made up of the Chief Information Officer (CIO), acquisition and procurement personnel, General Counsel, and supply chain subject matter experts. The team must lead supply chain risk identification and build SCRM policies and contract requirements into the Organization’s acquisitions. The team must define supply chain risk tolerance levels and drive the use of SCRM principles in the Organization’s system development life cycle (SDLC). The team must record its membership and keep it current.

SR-03 — Supply Chain Controls and Processes #

Baselines: Low / Moderate / High CSF 2.0: GV.RM (Risk Management Strategy), GV.SC (Cybersecurity Supply Chain Risk Management)

Requirement:

1. Establish a process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes of [Assignment: organization-defined system or system component — to be defined] in coordination with [Assignment: organization-defined supply chain personnel — to be defined];
2. Employ the following controls to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events: [Assignment: organization-defined supply chain controls — to be defined]; and
3. Document the selected and implemented supply chain processes and controls in [Selection (one or more): security and privacy plans; supply chain risk management plan; [organization-defined] — to be defined].

Implementation guidance:

The CISO team, Mission/Business Owners, and the Office of Acquisitions must jointly run processes that identify and address weaknesses and deficiencies in the supply chain. These processes cover the supply chain elements and processes behind all of the Organization’s IT systems and components. To limit exposure from supply chain events, the Office of Acquisitions must buy through federal-wide acquisition vehicles. Examples are National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) and General Services Administration (GSA) Advantage. The vetting and contract protections of those vehicles serve as supply chain controls. The CISO must document the processes and controls the Organization selects in the Supply Chain Risk Management Strategy and Implementation Plan (PLAN-SCRM-001). Each System Owner must document them in the system’s System Security and Privacy Plan (SSPP). This lets an assessor trace what protects each acquisition. The CISO team must address every weakness it finds.

SR-05 — Acquisition Strategies, Tools, and Methods #

Baselines: Low / Moderate / High CSF 2.0: GV.RM (Risk Management Strategy), GV.SC (Cybersecurity Supply Chain Risk Management)

Requirement:

Employ the following acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks: [Assignment: organization-defined strategies, tools, and methods — to be defined].

Implementation guidance:

The Office of Acquisitions must complete all IT supply purchases through compliant Government-wide contract vehicles, such as the GSA Schedules and the NASA Solution for Enterprise-Wide Procurement (SEWP). The Office of Acquisitions must treat any purchase outside these vehicles as an exception that needs a documented justification and the approval of the CISO and the Contracting Officer. The CISO’s staff must review every IT purchase request, including purchase-card buys, for supply chain risk before award. Network-connected devices, critical software, and components of moderate- or high-impact systems need a full supplier assessment. The Contracting Officer must not award until the CISO records in writing that the risk is acceptable.

SR-08 — Notification Agreements #

Baselines: Low / Moderate / High CSF 2.0: GV.RM (Risk Management Strategy), GV.SC (Cybersecurity Supply Chain Risk Management)

Requirement:

Establish agreements and procedures with entities involved in the supply chain for the system, system component, or system service for the notification of supply chain compromises and results of assessment or audits.

Implementation guidance:

The Contracting Officer must include notification terms in every agreement with an entity in the supply chain for systems, components, and services. The terms must require the entity to notify the Organization of a supply chain compromise and to share the results of relevant assessments or audits. The entity must identify the affected systems, components, or services, the supply chain risk involved, and the extent of any compromise. It must also report the remediation status or a remediation plan with milestones and deadlines. The Contracting Officer must confirm the terms before award. The CISO must define where the Organization receives notifications so that they reach security response staff without delay. The CISO must share relevant supply chain risk information with the Federal Acquisition Security Council, as the Federal Acquisition Supply Chain Security Act of 2018 provides.

SR-10 — Inspection of Systems or Components #

Baselines: Low / Moderate / High CSF 2.0: GV.RM (Risk Management Strategy), GV.SC (Cybersecurity Supply Chain Risk Management)

Requirement:

Inspect the following systems or system components [Selection (one or more): at random; at [organization-defined]; upon [organization-defined] — to be defined] to detect tampering: [Assignment: organization-defined systems or system components — to be defined].

Implementation guidance:

The System/Application Administrator must inspect the Organization’s IT systems to detect tampering. An inspection takes place when the CISO or the ISSO directs one. An inspection also takes place when there is an indication of need: damaged packaging, signs of physical tampering on a device, or a change in hardware specifications from what the Organization ordered. During deployment, the System/Application Administrator must inspect each asset to confirm that its components match the purchase order. This happens before the asset enters service. The System/Application Administrator must report suspected tampering to the CISO and the ISSO immediately. The administrator must hold the asset out of service until the inspection resolves the question.

SR-11 — Component Authenticity #

Baselines: Low / Moderate / High CSF 2.0: GV.RM (Risk Management Strategy), GV.SC (Cybersecurity Supply Chain Risk Management)

Requirement:

1. Develop and implement anti-counterfeit policy and procedures that include the means to detect and prevent counterfeit components from entering the system; and
2. Report counterfeit system components to [Selection (one or more): source of counterfeit component; [organization-defined]; [organization-defined] — to be defined].

Implementation guidance:

The CISO must maintain anti-counterfeit measures that detect counterfeit components and prevent them from entering the Organization’s systems. The measures apply to hardware, software, and firmware. They rest on two practices: buying through vetted acquisition channels and verifying what arrives against what the Organization ordered. System/Application Administrators must verify each component at receipt. System/Application Administrators must report a counterfeit or suspect component to the personnel and roles defined in the Organization Incident Response Standard and to the Contracting Officer. This starts security response and supplier accountability together. System/Application Administrators must not install a suspect component. The Organization must not return a confirmed counterfeit to the supply chain.

SR-11(1) — Anti-counterfeit Training #

Baselines: Low / Moderate / High

Requirement:

Train [Assignment: organization-defined personnel or roles — to be defined] to detect counterfeit system components (including hardware, software, and firmware).

Implementation guidance:

The Organization must train its system and network administrators, ISSOs, and the CISO team to detect counterfeit system components, including hardware, software, and firmware. Supervisors must make sure each person completes the training before taking on receipt, inspection, or supply chain assessment duties. The Organization must record each completion. People who inspect what the Organization installs must be able to recognize what it must never install.

SR-11(2) — Configuration Control for Component Service and Repair #

Baselines: Low / Moderate / High

Requirement:

Maintain configuration control over the following system components awaiting service or repair and serviced or repaired components awaiting return to service: all.

Implementation guidance:

The Organization must keep configuration control over all of its IT systems and components that are waiting for service or repair, and over serviced or repaired components that are waiting to return to service. System/Application Administrators must record each component’s configuration before it leaves their custody and must verify the configuration when it returns. No repaired component may reconnect until the verification passes. The Organization treats a repair as a supply chain transaction and inspects a returned component with the same care as a new delivery.

SR-12 — Component Disposal #

Baselines: Low / Moderate / High CSF 2.0: GV.RM (Risk Management Strategy), GV.SC (Cybersecurity Supply Chain Risk Management)

Requirement:

Dispose of [Assignment: organization-defined data, documentation, tools, or system components — to be defined] using the following techniques and methods: [Assignment: organization-defined techniques and methods — to be defined].

Implementation guidance:

The Organization must dispose of personally identifiable information (PII), of information and systems that support primary mission essential functions, of High Value Assets, and of critical software using approved techniques and procedures. Those techniques and procedures are in the Organization Media Sanitization and Destruction Procedure and the Organization Asset Management Procedure. System Owners must make sure disposal follows those procedures at every life cycle stage, whether prototype, operations, or retirement. System/Application Administrators must carry out each disposal and record it. No asset in scope may leave the Organization’s control with recoverable information on it. The System/Application Administrator must document each disposal well enough that an assessor can trace the asset from service to its sanitized end.

Supply Chain Events and Pre-Award Review #

A supply chain event is a sign that a product, service, or supplier may put the Organization at risk. Examples are suspected tampering, counterfeit goods, or a supplier named in a federal prohibition. An event becomes a supply chain incident when the CISO confirms an unlawful purchase or the event becomes a security incident.

• Each employee and contractor must report a suspected supply chain event to the CISO without delay.
• The CISO must decide whether each event is a supply chain incident and record the decision in the governance, risk, and compliance (GRC) system.
• The CISO must handle each supply chain incident with the Incident Response Team.
• The CISO must share relevant supply chain risk information with the Federal Acquisition Security Council, under 41 U.S.C. 1321-1328 and 41 CFR Part 201-1.
• The CISO must review each IT purchase before award, including each purchase made with a government purchase card.
• The Contracting Officer must not award until the CISO records in writing that the supply chain risk is acceptable.
• To exclude a source under 41 U.S.C. 4713, the agency head must decide in writing after a joint recommendation from the CIO and the chief acquisition officer.
• The CISO must keep a list of critical suppliers and review it each year, as NIST SP 800-161 Rev. 1 describes.

Source: Federal Acquisition Supply Chain Security Act of 2018 (41 U.S.C. 1321-1328); 41 CFR Part 201-1; 41 U.S.C. 4713; NIST SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (2022).

Related Required Processes #

• Each cloud service provider in a contractor’s Controlled Unclassified Information (CUI) enclave holds a Federal Risk and Authorization Management Program (FedRAMP) Moderate or higher authorization, or meets equivalent requirements. The CISO checks this before award, as the System and Services Acquisition procedure describes.

4. Roles and Responsibilities #

These roles apply across this policy. Each System Owner records the system-specific assignments in the system’s System Security and Privacy Plan (SSPP).

5. Performance Measurement #

The CISO manages this policy with the measures below, which meet the IG FISMA maturity model’s Level 4 (Managed and Measurable) criteria. The CISO collects and trends the measures and reports them to the CIO and the Authorizing Officials. When a measure moves away from its target, the CISO starts corrective action through the plan of action and milestones (POA&M) process.

The CISO keeps the measurement data for the annual IG FISMA evaluation and for trend analysis across reporting periods.

6. Compliance and Enforcement #

Every employee, contractor, and other user with access to an information system that the Organization operates, or that others operate for it, must comply with this policy. The CISO records each case of non-compliance as a finding in the Organization’s continuous monitoring program. The ISSO tracks the finding to resolution as a POA&M item, as OMB Circular A-130 and NIST SP 800-37 Rev. 2 describe.

A violation of this policy can lead to suspension of system access, withdrawal of the system’s authorization to operate (ATO), and administrative or disciplinary action under applicable law, regulation, and human capital policy.

The Inspector General assesses the maturity of supply chain risk management controls each year through the IG FISMA reporting metrics. The target maturity level for this policy area is Level 4: Managed and Measurable.

7. Continuous Improvement #

Level 4 is the minimum the Organization aims for. To meet the IG FISMA maturity model’s Level 5 (Optimized) criteria, the CISO improves supply chain risk management through these commitments:

1. Review the performance measures in this document at least annually; where a measure has met its target for four consecutive periods, tighten the target or replace the measure with a more demanding indicator.
2. Conduct an annual effectiveness review of this policy area using IG FISMA audit results, assessment findings, incident data, and metric trends; document resulting changes in the revision history.
3. Feed lessons learned from incidents, assessments, and exercises into updates of this document and its procedures within 90 days of the triggering event.
4. Benchmark against the IG FISMA maturity model annually and maintain a documented plan to reach and sustain Level 4 (Managed and Measurable), with a roadmap toward Level 5 (Optimized).
5. Continuously monitor critical suppliers (financial, geopolitical, breach intelligence) rather than assessing only at onboarding.
6. Automate SBOM-to-KEV correlation so newly disclosed component vulnerabilities surface within 24 hours.

8. Exceptions and Waivers #

The CISO may grant an exception to this policy only when compliance is not technically feasible or would harm the mission. To request one, the System Owner sends the CISO a written request that includes:

1. A business justification and a risk assessment.
2. Compensating controls that reduce the risk the exception creates, following the NIST SP 800-53B guidance on compensating controls.
3. A proposed end date no more than one year away.

The CISO decides each request in coordination with the Authorizing Official. An exception that involves privacy risk also needs the agreement of the Senior Agency Official for Privacy (SAOP). The CISO re-evaluates each exception when it comes up for renewal. The System Owner records each approved exception in the system’s SSPP, and the ISSO tracks it as a POA&M item.

9. References #

These are the sources this document cites, with a link to each official text.

• 15 CFR Part 791: Securing the Information and Communications Technology and Services Supply Chain, July 18, 2024.
• 41 CFR Part 201-1: Federal Acquisition Security Council (FASC) — Rules and Procedures, August 26, 2021.
• 2026 Minimum Elements for a Software Bill of Materials (SBOM) — CISA/NSA/FBI joint guidance: CISA/NSA/FBI joint guidance, July 29, 2026.
• CISA BOD 17-01: Removal of Kaspersky-branded Products, September 13, 2017.
• Exclusion and Removal of Acronis Products and Services from Federal Civilian Executive Branch Information Technology Systems, July 31, 2026.
• Exclusion and Removal of DeepSeek Products and Services from Federal Civilian Executive Branch Information Technology Systems, July 24, 2026.
• Executive Order 13800: Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, May 11, 2017.
• Executive Order 13873: Securing the Information and Communications Technology and Services Supply Chain, May 15, 2019.
• Executive Order 14028: Improving the Nation’s Cybersecurity, May 12, 2021.
• FAR 52.204-23: Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab Covered Entities, July 16, 2018.
• FAR 52.204-25: Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment (Section 889; with FAR 52.204-24 and 52.204-26 representations), August 13, 2020.
• FAR 52.204-27: Prohibition on a ByteDance Covered Application, June 2, 2023.
• FAR 52.204-30: Federal Acquisition Supply Chain Security Act Orders — Prohibition (with FAR 52.204-29 representation and disclosures), December 4, 2023.
• FAR: Prohibition on Certain Semiconductor Products and Services (proposed rule implementing FY2023 NDAA §5949), February 17, 2026.
• Federal Acquisition Regulation (FAR), current text.
• Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
• FIPS 200: Minimum Security Requirements for Federal Information and Information Systems, March 2006.
• Functions and authorities of the Federal Acquisition Security Council (41 U.S.C. § 1323), December 21, 2018.
• NIST Cybersecurity Framework 2.0, February 26, 2024.
• NIST SP 800-37 Rev. 2: Risk Management Framework for Information Systems and Organizations, December 2018.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• NIST SP 800-53B: Control Baselines for Information Systems and Organizations, September 2020.
• NIST SP 800-160 Rev. 1: Engineering Trustworthy Secure Systems, November 2022.
• NIST SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, November 1, 2024.
• NIST SP 800-218: Secure Software Development Framework (SSDF), February 2022.
• OMB Circular A-123: Management’s Responsibility for Internal Control, March 10, 2026.
• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.
• OMB M-26-05: Adopting a Risk-based Approach to Software and Hardware Security, January 23, 2026.
• Requirements for executive agencies (Federal Acquisition Supply Chain Security Act) (41 U.S.C. § 1326), December 21, 2018.
• Strengthening and Enhancing Cyber-capabilities by Utilizing Risk Exposure Technology Act (SECURE Technology Act) — Federal Acquisition Security Council (Pub. L. 115-390, Title II; 41 U.S.C. §§ 1321–1328; 41 U.S.C. § 4713), December 21, 2018.