240-110-44 Supply Chain Risk Management (SCRM).pdf

DISA INSTRUCTION 240-110-44

SUPPLY CHAIN RISK MANAGEMENT

Originating Center:

Effective:

Releasability:

Reissues and Cancels:

Approved by:

Operations and Infrastructure Center Disa.meade.ce.mbx.supply-chain-risk-management@mail.mil

August 26, 2022

P (Cleared for public release)

DISAI 240-110-44, “Supply Chain Risk Management, September 12, 2014

Teresa M. Pitts, Chief of Staff

Purpose: This issuance:

• Establishes policy for the Defense Information Systems Agency’s (DISA) Enterprise Supply Chain Risk Management (SCRM) Program.

• Provides roles and responsibilities for the protection of DISA’s mission critical functions, including risk analysis, intelligence assessments, risk mitigation, monitoring, reporting, and notification.

PITTS.TERES Digitally signed by

A.M.11477384 8451

PITTS.TERESA.M.114773

51 Date: 2022.08.26 17:51:19 -04'00'

DISAI 240-110-44 August 26, 2022

TABLE OF CONTENTS

SECTION 1: GENERAL ISSUANCE INFORMATION

1.1 Applicability

1.2. Policy

SECTION 2: RESPONSIBILITIES

2.1. Operations and Infrastructure Center

2.2. Cyberspace Operations Directorate Executive

2.3. SCRM Review Board

2.4. Office of General Counsel (OGC)

2.5. Component Acquisition Executive (CAE)

2.6. Procurement Services Directorate (PSD)

2.7. Risk Management Executive (RME)

2.8. Digital Capabilities and Security Center (DCSC) Executive

2.9. Chief, Security Division (MP6)

2.10. DISA Program Managers and Division Chiefs

2.11. Approved Product Certification Office (APCO)

REFERENCES

SECTION 1: GENERAL ISSUANCE INFORMATION

1.1 APPLICABILITY. This issuance applies to Defense Information Systems Agency (DISA) and other components of the Department of Defense (DoD) over which the Agency has been authorized administrative control.

1.2. POLICY. This issuance is published in accordance with (IAW) the authority contained in DoD Instruction (DoDI) 5200.44, Protection of Mission Critical Functions to Achieve Trusted Systems and Networks (TSN), 5 November 2012, Change 3, 15 October 2018.

a. This issuance establishes Agency-wide policy to minimize the supply chain risk to

DoD’s information and communications technology (ICT) and critical infrastructure, ensuring mission critical systems will not be impaired due to vulnerabilities in system design, sabotage, or subversion of a system’s mission critical functions or critical components, by foreign intelligence, terrorists, or other hostile elements.

b. All DISA programs, projects, services, enterprise services, initiatives, and other acquisition-related matters will execute supply chain risk management (SCRM) activities in compliance with applicable Federal laws and DISA SCRM Program instructions.

c. All applicable acquisitions will go through the ICT SCRM process: criticality analysis, due diligence assessment, threat analysis, and risk assessment. The DISA SCRM Program will document findings and recommendations and report to DISA leadership via the SCRM Review Board.

d. SCRM risk findings will be adjudicated across the Agency by key stakeholders.

Critical findings will be delivered to the Director.

SECTION 2: RESPONSIBILITIES

2.1. OPERATIONS AND INFRASTRUCTURE CENTER. The Operations and Infrastructure Center will:

a. Ensure effective supportability and sustainment of the ICT SCRM Program within

DISA’s Operations and Infrastructure Center.

b. Provide Director’s intent to guide the ICT SCRM Program and report SCRM risk findings to DISA leadership.

c. Act as DISA’s SCRM Senior Agency Official in response to DoD Chief Information

Officer’s (CIO’s) requirement and chair the SCRM Review Board.

d. Deliver critical SCRM findings to the Director.

e. Facilitate the DISA SCRM Review Board process and activities.

2.2. CYBERSPACE OPERATIONS DIRECTORATE EXECUTIVE. The Cyberspace Operations Directorate Executive will:

a. Provide functional area support for the execution of this issuance.

b. Serve as the Office of Primary Responsibility (OPR) for operationalization of DISA’s

ICT SCRM strategy and program, enabling risk owners to identify, assess, and manage risks to the supply chain.

c. Establish supply chain risk due diligence capabilities for decision support and continuous monitoring of critical suppliers.

d. Coordinate and prioritize requests for all-source threat assessments from the Defense Intelligence Agency (DIA) SCRM Technology Assessment Center (TAC); provide personnel support to DIA SCRM TAC to conduct threat analysis of suppliers of critical components IAW DoDI 5200.44.

e. Prepare SCRM Risk Recommendations on SCRM risks for DISA leadership, military departments, DoD Components, and mission partners.

f. Develop Agency-level SCRM processes and guidance in support of DISA’s SCRM strategy and IAW applicable laws, executive orders, directives, regulations, policies, standards, and guidance. Integrate SCRM activities into mission assurance IAW DoDI 3020.45, Mission Assurance Construct, 14 August 2018.

g. Integrate SCRM assessments into the DoD Information Network (DODIN) Approved

Provider List (APL) process, including coordination on restricted or prohibited suppliers.

Coordinate with Approved Products Certification Office (APCO) to provide SCRM and threat information that may impact testing and product evaluations. Collaborate with cybersecurity personnel on the identification, development, and implementation of mitigating actions for products.

h. Coordinate with DoD CIO; obtain latest guidance to ensure the integration of TSN concepts and processes into acquisition IAW DoDI 5200.44.

i. Coordinate with Procurement Services Directorate (PSD) and Agency program managers (PMs) to identify programs to review for supply chain risk; provide feedback to PSD and Agency Centers and Program Management Offices on new threats and authorities to integrate into the acquisition process and contract language.

j. Coordinate with Risk Management Executive (RME) to provide SCRM and threat information that may impact implementation of information (IT) technology in DISA environments. Collaborate with cybersecurity personnel on the identification, development, and implementation of mitigating actions for IT to support and comply with Risk Management Framework (RMF) requirements IAW National Institute of Standards & Technology (NIST) Special Publication 800-53, Security and Privacy Controls for Information Systems and Organizations, September 2020.

k. Collaborate with PM to ensure due diligence is conducted throughout the lifecycle of the program. This includes identifying mission-critical ICT through a criticality analysis as defined in chapters three and nine of the Defense Acquisition Guidebook.

l. Maintain DISA’s ICT SCRM awareness and training program, and a repository of known SCRM threats, vulnerabilities, and reporting.

2.3. SCRM REVIEW BOARD. The SCRM Review Board will:

a. Be chaired by the Operations and Infrastructure Center Executive with the Cyberspace

Operations Directorate Executive, RME, and the Digital Capabilities and Security Center Executive as members.

b. Be advised by General Counsel, the PSD, and the Component Acquisition Executive.

c. Meet as mission dictates via the Cybersecurity Senior Forum.

d. As necessary, identify and prioritize DISA systems and services for execution within

DISA’s ICT SCRM program.

e. Oversee and facilitate the development and execution of DISA’s ICT SCRM strategy aligned to DISA Director’s mission and objectives and DoD guidance.

f. Evaluate SCRM risk and determine risk mitigation actions in concert with responsibilities and authorities on the DODIN.

g. Make supply chain risk mitigation decisions to support the DISA Director’s Agency Mission Essential Task List.

h. Render executive-level SCRM Risk Recommendations to support Agency-level

SCRM.

2.4. OFFICE OF GENERAL COUNSEL (OGC). The OGC will provide advice to the ICT SCRM Office on any legal matters that arise related to the SCRM Program and associated activities.

2.5. COMPONENT ACQUISITION EXECUTIVE (CAE). The CAE will provide advance notice to the ICT SCRM Office on upcoming programmatic SCRM requirements upon source selection of suppliers for hardware, software, ICT services, or software-as-a-service.

2.6. PROCUREMENT SERVICES DIRECTORATE (PSD). The PSD will:

a. Develop and review SCRM Risk Recommendations.

b. Oversee and facilitate development of processes, procedures, and contract language to support DISA and DoD SCRM policy, and propagate updates throughout DISA, Defense Information Technology Contracting Office, and to DISA mission partners.

c. Ensure that all procurements for hardware, software, and services include applicable

SCRM requirements for vendors and subcontractors IAW NIST SP 800-53.

d. Pursue contractual remedies for Project Management Office-documented vendor failures to adhere to SCRM contractual requirements.

2.7. RISK MANAGEMENT EXECUTIVE (RME). The RME will:

a. Serve as a member on the SCRM Review Board.

b. Develop and review SCRM Risk Recommendations.

c. Integrate DISA’s ICT SCRM with existing system development lifecycles and RMF processes for Applicable Systems.

d. Assure the application of SCRM RMF requirements IAW NIST SP 800-53.

2.8. DIGITAL CAPABILITIES AND SECURITY CENTER (DCSC) EXECUTIVE. The DCSC Executive will:

a. Serve as a member on the SCRM Review Board.

b. Develop and review SCRM Risk Recommendations.

c. Evaluate SCRM risk and determine risk mitigation actions in concert with responsibilities and authorities on the DODIN.

2.9. CHIEF, SECURITY DIVISION (MP6). The Chief, MP6, will:

a. Designate a liaison/point of contact to work with DISA’s ICT SCRM Office.

b. Coordinate and provide support to the DISA ICT SCRM Office on reports of SCRM-related malicious activities.

2.10. DISA PROGRAM MANAGERS AND DIVISION CHIEFS. The PMs and Division Chiefs will:

a. Conduct criticality analyses to identify and prioritize mission critical functions and components.

b. Manage supply chain vulnerability and risk through secure system design IAW DoDI 5200.44.

c. Engage DISA’s ICT SCRM Office for guidance on managing supply chain risk and ensure evaluations follow the latest required SCRM guidance and legislation.

d. Coordinate with the DISA ICT SCRM Office to conduct due diligence on critical suppliers, components, ICT services, and technologies.

e. Implement appropriate supply chain risk mitigations and share follow-up measures with the DISA ICT SCRM Office.

f. Integrate SCRM into ICT acquisition processes and procedures IAW applicable laws and regulations.

g. Request threat analysis and threat assessments from the Defense Intelligence Agency

SCRM TAC through DISA’s ICT SCRM Office IAW DoDI 5200.44.

h. Document risk mitigation activities in Program Protection Plans and relevant cybersecurity plans and documentation IAW DoDI 5000.83, Technology and Program Protection to Maintain Technological Advantage, 20 July 2020, and DoDI 8500.01, Cybersecurity, 14 March 2014, (Incorporating Change 1, 7 October 2019).

i. Comprehensively document vendor failure to adhere to SCRM contractual requirements.

2.11. APPROVED PRODUCT CERTIFICATION OFFICE (APCO). The APCO will:

a. Engage the DISA SCRM Office for guidance on managing supply chain risk and ensure evaluations follow the latest required SCRM guidance and legislation.

b. Work with DISA ICT SCRM Office to initiate SCRM review of APL applicants and renewals. Receive threat and risk recommendations from the DISA ICT SCRM Program.

Identify and execute appropriate responses including denial, use restrictions, or condition of fielding requirements.

c. Coordinate with the DISA ICT SCRM Office for newly identified threats or vulnerabilities for products already on the APL. Identify and recommend appropriate mitigation actions including removal, use restrictions, or condition of fielding requirements.

REFERENCES

Defense Acquisition Guidebook, Washington, D.C., 2021

DoDI 3020.45, Mission Assurance Construct, 14 August 2018

DoDI 5000.83, Technology and Program Protection to Maintain Technological Advantage, 20 July 2020

DoDI 5200.44, Protection of Mission Critical Functions to Achieve Trusted Systems and Networks (TSN), 5 November 2012, Change 3, 15 October 2018.

DoDI 8500.01, Cybersecurity, 14 March 2014, (Incorporating Change 1, 7 October 2019)

National Institute of Standards & Technology (NIST) Special Publication 800-53 - Security and Privacy Controls for Information Systems and Organizations, September 2020