Government is No Better at Managing Supply Chain Risk Than we Are
The GAO, formerly known as the General Accounting Office, works for Congress and does studies of how horribly inefficient the government is. In theory, that is so Congress can create new laws to make them do what any sensible organization would do without the laws. Here is one example.
The GAO reviewed the security practice of 23 government agencies with regard to information and communications technology products (what you and I call networks and computers). They identified 7 practices for managing these risks and then they graded the agencies on how they were doing. What they found was:
- Few implemented the practices
- None had FULLY implemented the practices
- 14 had implemented NONE of the practices
Feel better? The only downside is the government gets hacked too – as we have seen very publicly lately.
Here are some of the highlights from the report.
Here is where these agencies get their stuff from. This is not where the sales office is, but rather where the stuff is made.
The one practice that was implemented by the most agencies – that only included 6 of 23 agencies. OUCH!
So then they tallied up the results. Here is what they found:
Notice all the white? That is the part where the agencies are not implementing any part of the practice to reduce their risk. The vast majority of the agencies are asleep at the switch.
The most common excuse given was “no one told me how to do this” or something close to that. So, a billion dollar agency, apparently, needs to be treated likely a toddler and told how to do its job. Lets ignore for the moment that NIST issued guidance in 2015 and the OMB told all agencies to implement supply chain risk management (SCRM) in 2016. But no one held their hand. Or, until now, swatted their behind.
Most agencies, when called on the carpet by the GAO said, oh, my bad, I will fix that (yeah, maybe). A few said bug off. Those are the ones who should not be allowed to use computers or networks.
Here are the 7 areas that the GAO asked about. See how many of these you are doing company wide.
- establishing executive oversight of ICT activities, including designating responsibility for leading agency-wide SCRM activities;
2. developing an agency-wide ICT SCRM strategy for providing the organizational context in which risk-based decisions will be made;
3. establishing an approach to identify and document agency ICT supply chain(s);
4. establishing a process to conduct agency-wide assessments of ICT supply chain risks that identify, aggregate, and prioritize ICT supply chain risks that are present across the organization;
5. establishing a process to conduct a SCRM review of a potential supplier that may include reviews of the processes used by suppliers to design, develop, test, implement, verify, deliver, and support ICT products and services;
6. developing organizational ICT SCRM requirements for suppliers to ensure that suppliers are adequately addressing risks associated with ICT products and services; and
7. developing organizational procedures to detect counterfeit and compromised ICT products prior to their deployment.
Credit: the Government Accountability Office
by 