SCRM_Plan_Requirements_F-15.pdf

Supply Chain Risk Management (SCRM) Plan

1.1.1 Provide a comprehensive Supply Chain Risk Management (SCRM) Plan and execute processes for identifying supply chain risks as early as possible. The SCRM plan will address the broad spectrum of supply chain risks that have the potential to: jeopardize the integrity of products, services, people, and technologies; compromise intellectual property; disrupt the flow of product, materiel, information, and finances needed for continued Air Force operations;

and drive materiel cost increases to the program. The plan and processes applies to the Collins and their suppliers, subcontractors, associated integrators, and vendors, spanning the entirety of the supply chain, from raw material stage to delivery of a finished product.

1.1.2 The SCRM plan must clearly address the following:

(a) Continuity of Operations (COOP) - Collins will develop and/or update a Continuity of Operations Procedure/Plan (COOP), also known as a Business Operations Plan, which outlines the processes and actions to prepare for, and respond to, planned/unplanned supply chain challenges.

(b) Foreign Influence - Collins will disclose any Foreign Ownership (outside of MOD), Control, or Influence (FOCI) for the purpose of initial or continued facility clearance eligibility. A Standard Form 328 Certificate Pertaining to Foreign Interest shall be submitted to the Government cognizant security office specified in each DD254 (Contract Security Classification Specification). Foreign Disclosure Restrictions apply.

(c) Cyber Security - Collins will implement a cybersecurity protection of supply chain information plan and provide a copy to the U. S. Government. As part of this process Collins will conduct early and continuous monitoring throughout the life of the agreement to prevent or reduce impacts of cyber vulnerabilities where adversaries are able to exploit, steal, alter, manipulate, interrupt, or destroy system functionality, information, or technology. The plan must:

(i) Include a description of how Collins will protect the supply chain from exploitation due to the insertion of counterfeits/malware, unauthorized production, tampering, theft, insertion of malicious software and hardware, functionality alteration, and any other elements that would allow adversaries to gain unauthorized access to data, alter data, interrupt communications, or otherwise disrupt operations.

(ii) Inform the U. S. Government of any instances of unauthorized access and/or compromise, such as those listed in item “i” to Collins digital information and parts and components.

(iii) Ensure all hardware, with special emphasis on lowest critical components (CCs) and components containing Critical Program Information (CPI), are from trusted sources and are manufactured by approved personnel as documented in Coll ins Security Plan.