Supply Chain Risk Management (SCRM)

Supply Chain Risk Management (SCRM) in the federal government context is the systematic practice of identifying, assessing, and mitigating risks that arise from vulnerabilities, threats, and adversarial activities targeting the information and communications technology (ICT) supply chain used in government systems and programs.

What is SCRM?

Federal SCRM requirements have expanded significantly following high-profile supply chain incidents - most notably the SolarWinds compromise (2020), which demonstrated how malware inserted into a commercial software update could propagate into thousands of government and private sector networks. The SCRM framework for federal contractors draws from Executive Order 14028 (Improving the Nation's Cybersecurity, May 2021), NIST SP 800-161 (Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations), and DoD acquisition regulations.

SCRM encompasses several threat categories: counterfeit or substandard components, software with embedded malicious code, hardware with backdoors or trojans, single-source dependencies that create strategic vulnerabilities, and foreign adversary involvement in key supply chain roles. For defense contractors, the most regulated aspects involve Section 889 of the NDAA (prohibiting telecommunications equipment from Huawei, ZTE, and other designated Chinese firms), DoD SCRM requirements in DFARS 252.239-7018, and program-specific requirements for critical defense programs that mandate supply chain audits and component traceability.

For IT contractors, SCRM practices include: maintaining a Software Bill of Materials (SBOM) documenting all components and their origins, vetting software developers and vendors with access to government systems, monitoring for vulnerabilities in open-source components, and conducting supplier assessments for critical system components. These practices are increasingly required in IT contracts and are evaluated as part of CMMC and FedRAMP assessments.

Why SCRM matters for government contractors

SCRM is transitioning from a voluntary best practice to a contractual requirement across defense and civilian agency IT contracts. Contractors who cannot demonstrate SCRM capabilities - supplier vetting processes, SBOM management, counterfeit part controls, and foreign ownership screening for critical suppliers - face growing bid disqualification risk. The regulatory trajectory is toward more mandatory SCRM requirements, making investment in SCRM capabilities now a competitive necessity for the medium term.

Example

A defense electronics firm delivers hardware systems for radar applications. Under its contracts' DFARS SCRM clauses, the firm maintains a tiered supplier assessment program: critical suppliers undergo annual audits including facility visits and component origin verification; standard suppliers complete annual self-assessments; low-risk suppliers are monitored for known vulnerability databases. When the firm identifies that a sub-tier supplier of memory chips has been acquired by a foreign entity from a country of concern, the firm immediately reports to its contracting officer, conducts a formal SCRM risk assessment, and initiates qualification of an alternative domestic supplier. The entire process is documented in the firm's SCRM plan required by the contract.

Frequently Asked Questions

What is a Software Bill of Materials and why is it required?

A Software Bill of Materials (SBOM) is a formal inventory of all components, libraries, and dependencies included in a software product, analogous to an ingredient list for software. Executive Order 14028 directed NIST and CISA to develop SBOM standards and guidance, and federal agencies increasingly require SBOMs from software vendors to support vulnerability management - if a vulnerability is discovered in a specific library, an SBOM lets agencies quickly identify which systems are affected. DoD and civilian agencies are incorporating SBOM requirements into software acquisition contracts.

What is Section 889 and how does it affect my contracts?

Section 889 of the NDAA (2019) prohibits federal agencies from procuring or using telecommunications equipment or services from Huawei, ZTE, Hytera Communications, Hikvision, Dahua Technology, and their subsidiaries. Section 889 also prohibits agencies from entering contracts with entities that use such equipment in their systems. Contractors certify compliance with Section 889 through representations in SAM.gov. Contractors who use any of the prohibited equipment in their networks, video surveillance systems, or other covered systems must replace that equipment before they can accurately certify compliance.

How does SCRM relate to CMMC?

CMMC Level 2 includes SCRM-related controls from NIST SP 800-171, primarily in the System and Communications Protection and Risk Assessment control families. CMMC Level 3 incorporates additional SCRM controls from NIST SP 800-172, including more advanced supply chain monitoring and incident response requirements. SCRM is thus both a standalone program requirement and an embedded component of CMMC compliance.

What are the consequences of a supply chain compromise under a government contract?

If a government contractor experiences a supply chain compromise - for example, malware discovered in software updates delivered to the government - the contractor faces multiple obligations: incident reporting requirements (72 hours under DFARS 252.204-7012 for CUI-related incidents), preservation of system images for government forensic investigation, potential contract suspension while the compromise is investigated, and possible False Claims Act exposure if prior SCRM certifications were inaccurate. The reputational and business consequences can be severe even for unintentional compromises if the contractor's SCRM program is found to be inadequate.