Partners,

As we continue to respond as a nation to coronavirus (COVID-19), we must remain vigilant of adversaries seeking to target our critical systems and disrupt our vital supply chains.

Now more than ever, resilient critical infrastructure is imperative for public health and safety and community well-being.  One of the Cybersecurity and Infrastructure Security Agency's (CISA) top priorities is securing the global Information and Communications Technology (ICT) supply chain.  Every day, ICT systems —those hardware, software, and services critical to communicating — support a broad range of critical infrastructure activities that collectively enable the provisioning of National Critical Functions (NCFs), such as generating electricity, operating hospitals, and supplying clean water.  ICT products and services also provide remote access into work environments, e-Learning capabilities, and mobile computing.  If vulnerabilities in the ICT supply chain are exploited, the consequences can affect all users of that technology or service.

CISA has published several resources on ICT supply chain risk management, to include a new ICT Supply Chain Essentials guide, to help partners and stakeholders deal with managing risks to their ICT supply chains.  Read, download, or share these resources to help raise awareness.

ICT Supply Chain Essentials guide for leaders and risk management professionals to understand where to start implementing SCRM

ICT Supply Chain Risk Management Fact Sheet includes these steps for organizations to improve their overall security posture

ICT SCRM Task Force Threat Scenarios Report for ICT threat sources and risks to the supplies, products, and services you purchase

ICT Response Paper on Executive Order 13873:  Methodology for Assessing the Most Critical Information and Communications Technologies and Services

For information on COVID-19, please visit www.cisa.gov/coronavirus.  To learn more about ICT supply chain risk management and to view online resources, check out our latest CISA blog post or visit www.cisa.gov/nrmc-scrm.

Cybersecurity and Infrastructure Security Agency