Katie Arrington, a previous Wash100 awardee who currently performs the duties of the Department of Defense’s chief information officer, has released a memorandum to help DOD better manage risks facing its information and communications technology supply chain.
In the June 5 memo, Arrington said she called for an update of the Requirements for the Acquisition of Digital Capabilities Guidebook concurrent with the Software Fast-Track, or SWFT, initiative development timeline.
DOD Software Fast-Track Initiative
In April, the acting CIO directed the establishment of the SWFT initiative to advance DOD’s adoption of best practices to transform the way it acquires, tests, authorizes and deploys secure software.
The 90-day SWFT initiative sought to define clear, specific cybersecurity and supply chain risk management requirements; secure information sharing mechanisms; rigorous software security verification processes; and federal government-led risk determinations to accelerate cybersecurity authorizations for secure, rapid software adoption.
According to Arrington, the update will build on 12 risk categories to facilitate the development of a comprehensive framework for managing ICT supply chain risks. The Office of the Assistant Secretary of Defense for Sustainment developed the risk categories.
The risk categories are regulatory and compliance; manufacturing and supply; foreign ownership, control, or influence; political; technology and cybersecurity; financial; economic; product quality and design; human capital; environmental; transportation and distribution; and infrastructure.
Key ICT Supply Chain Risk Management Requirements for DOD Components
The memo outlines key ICT supply chain risk management requirements for DOD components deploying commercial off-the-shelf products.
These include prioritizing software integrity in accordance with OMB Memorandum 22-18; ensuring that vendors adhere to a section of the fiscal year 2019 National Defense Authorization Act concerning a prohibition on certain telecommunications and video surveillance equipment from Huawei, ZTE and Hytera, among others; and ensuring that suppliers adhere to the DOD issued Security Requirements Guides and any accompanying Security Technical Implementation Guides.
DOD components should also obtain artifacts as part of the security authorization process, including hardware and software inventory list; incident response plan; software certification test results; and supply chain risk management policy.
