The bottom line is that none of the 23 agencies audited fully implemented foundational risk management practices.
Days after news that sophisticated hackers exploited a flaw in the SolarWinds Orion software to breach a major security company and victimized several federal agencies, the Government Accountability Office made public a major audit showing federal civilian agencies are failing to manage risks in the information and communication technologies supply chain.
Though GAO finished its audit several months ago, the timing of the release of the public version—which GAO shared Tuesday—underscored the audit’s significance: ICT supply chains are targets for adversaries, and without implementing “foundational” supply chain risk management, or SCRM, practices, agencies risk exploitation.
“Even if agencies had robust supply chain risk management processes in place, most likely this particular attack still would have happened because of the level of sophistication that was involved,” Carol Harris, director of GAO’s IT and cybersecurity team, told Nextgov regarding the SolarWinds breach. “However, if agencies have robust supply chain risk management processes in place, they would be better positioned to identify other attacks, maybe less sophisticated than this one, but also with attacks like these, the level of impact could have been potentially reduced as a result.”
The bottom line is that none of the 23 civilian agencies GAO audited fully implemented the seven foundational SCRM practices GAO identified using guidance from the National Institute of Standards and Technology. These seven practices include such steps as establishing oversight, developing agencywide ICT SCRM strategies, and establishing processes to review supplier security. Six agencies fulfilled the last practice in that list—making establishing SCRM supplier reviews the most popular practice—but a full 14 agencies hadn’t implemented any of the seven key practices. Agency names and other sensitive information were omitted from the public version of the audit.
The most common explanation agencies cited to explain why they’re lagging behind is that they are waiting for the Federal Acquisition Security Council to issue guidance. But Harris said, “that simply isn’t a legitimate reason.”
“NIST came out with their guidance back in 2015,” Harris said. “In fact, they had updated their cybersecurity framework and their risk management framework to include supply chain risk considerations in 2018. So, the guidance was out there, and that’s a reason why we made 145 recommendations to the 23 agencies to fill these gaps to institutionalize these practices at their agencies.”
That 145 number represents the total combined number of recommendations made to each individual agency. Harris added that implementing ICT SCRM has been an Office of Management and Budget requirement since 2016, “so there really is no excuse” for agencies to be putting off this work.
Offices of chief information officers across the federal government, which are typically working with limited resources, just aren’t prioritizing ICT SCRM, Harris said.
Jennifer Bisceglie, chief executive officer at Interos, which uses an artificial intelligence platform to analyze global supply chain risks, told Nextgov CIOs have a lot on their plates. But including ICT SCRM on the biannual Federal Information Technology Acquisition Reform Act Scorecard would help force a change.
The seven NIST foundational practices are necessary, Bisceglie said, but she would also like to see a sharing mechanism for agencies to be able to benefit from each others’ work analyzing vendors in the supply chain.
“It [would get] all boats to rise,” Bisceglie said. “If everybody starts doing their own analysis and doesn’t share, then somebody is going to be left out.”
Most agencies—17 of 23—agreed with GAO’s recommendations. One agency disagreed with all the recommendations, which Harris again attributed to the agency’s desire to wait for FASC guidance. Two agencies agreed with some, but not all, recommendations, and two neither agreed nor disagreed but indicated they would address the concerns.
“This GAO report from a timing standpoint, I’m hoping is seen as a real wake-up call and a real opportunity,” Bisceglie said.
