DID_82256A_SCRM.pdf

DATA ITEM DESCRIPTION

Title: SUPPLY CHAIN RISK MANAGEMENT (SCRM) PLAN

Number: DI-MGMT-82256A Approval Date: 20230203 AMSC Number: F10374 Limitation: N/A DTIC Applicable: No GIDEP Applicable: Yes Preparing Activity: 11 (AFLCMC/LZS) Project Number: MGMT-2022-030 Applicable Forms: N/A

Use/Relationship: The Supply Chain Risk Management (SCRM) Plan defines the structured, contractor-proposed SCRM strategy relative to the products and services to be provided by the prime, its suppliers, and subcontractors. The SCRM plan will include a systematic process used to identify, assess, handle, and monitor supply chain risks associated with the product or service to be provided. This information will be used by the Government to maintain oversight of the contractor’s holistic SCRM Plan to effectively handle risks within the supply chain.

This Data Item Description (DID) contains the format, content, and intended use information for the data deliverable resulting from the work task described in the solicitation.

This DID supersedes DI-MGMT-82256.

Requirements:

1. Reference documents. DI-MGMT-82255A, DoDI 5000.90, DoDM 4140.01. Copies of the DoD

Directives can be found at https://www.esd.whs.mil/DD/.

2. Format. Government directed electronic format shall be used to the fullest extent possible;

however, if none identified, the contractor’s electronic format, Microsoft Word® version .docx, is acceptable.

3. Content. The SCRM plan shall contain the following:

3.1 Cover and Title Page. This page shall identify the following:

a. SCRM Plan date of issue;

b. SCRM Plan document number;

c. Contract number;

d. Contractor’s name and address;

e. Title of plan;

f. Program title;

g. Security classification;

h. USD(R&E) Critical Technology List (if applicable);

i. Distribution statement; and

j. Destruction notice, if applicable.

k. Cybersecurity Maturity Model Certification (CMMC) certification level (Note: DoDI 5000.90

3.4.a)

Source: http://assist.dla.mil -- Downloaded: 2025-02-27T15:10Z Check the source to verify that this is the current version before use.

DI-MGMT-82256A

3.2 Revision Control. The SCRM plan shall contain a list of all revisions identifying the following information:

a. Each revision number;

b. Date of each revision;

c. Pages affected by each revision; and

d. Summary of major content changes.

3.3 Table of Contents. The table of contents shall identify each major section title, paragraph number, and starting page number for each major section.

3.4 Section Contents. The SCRM Plan shall address each major section identified below:

a. Scope. This section shall include:

(1) Defining SCRM applicability to the prime and all suppliers, subcontractors, associated integrators, and vendors;

(2) Defining SCRM as the coordinated, holistic approach, involving all supply chain stakeholders, which identifies, assesses, handles, and monitors supply chain risks associated with weaknesses, vulnerabilities, and threats, addressing both services and products; and

(3) Defining the supply chain as the linked activities associated with providing materiel from a raw material stage to an end user as a finished product.

b. SCRM Strategy. This section shall provide an overview of the contractor’s overall SCRM strategy. It will include how the contractor plans to identify, assess, handle, and monitor risks in the lifecycle supply chain that have the potential to jeopardize the integrity of assets, compromise related intellectual property, disrupt the flow of critical goods or services needed for continued Department of Defense (DoD) operations, unexpectedly drive materiel cost increases to programs, or compromise national security.

c. Responsible Organizational Component. This section shall include:

(1) Contractor’s organizational SCRM construct; and

(2) Contractor’s primary and alternate focal points’ contact information to include names, duty titles, addresses, telephone numbers, and email addresses.

d. SCRM Processes and Procedures. This section shall describe:

(1) Processes for: Protecting products and services throughout the entire lifecycle; identifying, assessing, handling, and monitoring potential supply chain threats, weaknesses, and vulnerabilities; and analyzing identified potential disruptions for the program’s supply chain, suppliers, products, technologies, and services; and

(2) Process for revising the SCRM Plan in accordance with government guidelines during the lifecycle of the program, and for providing a copy of the SCRM plan to the Government Product Support Manager or Program

Manager.

e. Supply Chain Risk Identification. This section shall describe in detail:

(1) Processes and tools utilized to identify supply chain risks and associated root causes as early as possible;

(2) Intelligence-based and counter-intelligence-based techniques and commercial business tradecrafts employed to uncover and map supplier networks; and

(3) Process for communicating supply chain risks to affected stakeholders and the Government Program Support Manager or Program Manager.

f. Supply Chain Risk Assessment. This section shall include:

(1) Process to scan the contractor’s supply chain network (to include sub-tier suppliers), applying risk categories, to identify and assess supply chain risks that could impact the Government’s program;

(2) Contractor’s methodology for assessing all vendors or sources of supply to identify potential threats and vulnerabilities;

(3) Processes for analyzing root causes and assigning a risk rating by assessing the likelihood of occurrence; and determining severity of impact to the contractor’s supply chain.

As proscribed in DoDM 4140.01 Supply Chain Materiel Management Policy, SCRM owners assess supply chain risk by determining the severity of impacts to 1.) integrity of goods and services; 2.) assurance of supply; and 3.) economic efficiency to the contractor’s supply chain.

Processes for assessing SCRM risk impacts are specific to risks originating from the supply chain and do not encompass all enterprise or program risks.

However, successful supply chain risk management does enable Program Managers to proactively manage risks associated with cost (economic efficiency), schedule (assurance of supply), and performance (integrity of products or services).

(4) Process to focus attention on critical risks and document in the Supply Chain Risk Register; and

(5) Process to report the Supply Chain Risk Register to the Government Product Support Manager or Program Manager on a quarterly basis.

g. Supply Chain Risk Handling. This section shall include:

(1) Supply chain risk handling plans to combat identified and potential supply chain risks. It shall include:

(a) A descriptive title for each supply chain risk;

(b) Root cause or trigger of each risk;

(c) Possible risk handling plan to alleviate each risk; and

(d) Description of events and activities intended to accept, avoid, mitigate, or transfer the risk, success criteria for each planned event, and residual risk rating (acceptable level of risk). Reference DI- MGMT-82255A Supply Chain Risk Register.

Source: http://assist.dla.mil -- Downloaded: 2025-02-27T15:10Z https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/414001p.pdf

(2) Methodology to prioritize potential supply chain risks;

(3) Process to capture risks and associated details, relative to the products and services to be provided, in a risk register.

h. Supply Chain Risk Monitoring. This section shall include:

(1) Process for the persistent and comprehensive monitoring and re-evaluation of supply chain risks and corresponding risk handling plans;

(2) Process for reporting risk monitoring information to the Government Product Support Manager or Program Manager quarterly; and

(3) The Supply Chain Risk Register will include a unique risk identifier, risk category and description, risk rating, risk handling response, responsible POC, expiration date, and current status. Reference DI-MGMT-82255A Supply Chain Risk Register.

i. SCRM Training. This section shall describe in detail:

(1) SCRM training that promotes an understanding of the basics of SCRM as a practice, the nature of risks facing supply chains, and the recommended approaches;

(2) SCRM-related course numbers, titles, sources, and descriptions;

(3) Number of personnel trained in each of the aforementioned courses; and

(4) Duty titles of personnel trained.

End of DI-MGMT-82256A.