Skip to content

ACT-IAC Industry Survey of C-SCRM Practices

Background: The government established a Cyber Supply Chain Risk Management (C-SCRM) Acquisition Community of Practice (ACoP) to broaden the level of awareness and develop agency maturity in the areas of acquisition, information and communication technology and services (ICTS) supply chain risk management, and cybersecurity across the Federal Government. 
 
One of the top priorities that the C-SCRM ACoP has taken on involves GSA and CISA co-leading an effort to mature the integration of C-SCRM into the acquisition process.  The outcome will be increased maturity on strategy, governance, and operations based on lessons learned.  The ACoP has established a working group in partnership with ACT-IAC to help ensure that the ICTS industry’s feedback and input informs the government of key challenges and opportunities that will influence the government’s approach and the development of potential requirements related to improving C-SCRM.

Government and Industry are co-leading the effort to mature the integration of C-SCRM into the acquisition process and have established a working group, in partnership with ACT-IACT, to assist in developing crucial data to address the multi-tiered approach.

ACT-IAC Member Feedback Request:  As key stakeholders, Industry partners are invited to their input and feedback to help define and prioritize C-SCRM challenges, issues, and opportunities that both Industry and Government face. The intent of this request is ensure that key decision-makers and influencers in government are informed by a diverse group of industry stakeholders representing various sizes and types of companies involved in the federal ICTS ecosystem.  All feedback will be anonymized. This is an opportunity for Industry to share thoughts, ideas, and lessons learned before new requirements and regulations are finalized.

C-SCRM: Cyber Supply Chain Risk Management (C-SCRM) is the process of identifying, assessing, and mitigating the risks associated with the distributed and interconnected nature of IT/OT product and service supply chains. It covers the entire life cycle of a system (including design, development, distribution, deployment, acquisition, maintenance, and destruction) as supply chain threats and vulnerabilities may intentionally or unintentionally compromise an IT/OT product or service at any stage.
1.Company Name(Required.)
2.Company Size(Required.)
3.Does the company hold any Socio-Economic Categories designation?(Required.)
4.Which of the below provisions accurately describes your company’s services? (Check all that apply)(Required.)
5.Does your organization have a contract with the government for Cyber Supply Chain Risk Management (C-SCRM) Program?(Required.)
6.If yes, Is the C-SCRM program utilizing requirements based on NIST publications, ISO standards, industry best practices, or other?
7.If no, does your company have C-SCRM capabilities, i.e. tools and other technical capabilities that could support a government program?
8.Does your company have an internal C-SCRM program?(Required.)
9.If yes, has your company established requirements for their suppliers?
10.If yes, does your company have policies and procedures to ensure that C-SCRM information is shared across the organization?
11.Would your company be interested in taking part as an Industry Stakeholder? This will entail at least one additional engagement and stakeholder listening session(s) with government stakeholders where your company can provide direct feedback in terms of lessons learned, prioritizing challenges, and real scenarios experienced. If so, provide the primary POC (name and email) to coordinate.
Program Example & Corporate Services Questions
12.For current programs (either as a prime or subcontractor), which of the services listed below does your company provide? (Check all that apply)(Required.)
13.For past programs (either as a prime or subcontractor), which of the services listed below did your company provide? (Check all that apply)(Required.)