IT Supply Chain Presents Numerous Information Security Risks to Federal Agencies

Reliance on a global supply chain introduces multiple risks to federal  information systems and underscores the importance of threat  assessments and risk mitigation. These risks include threats posed by  actors—such as foreign intelligence services or counterfeiters—who may  exploit vulnerabilities in the supply chain, thus compromising the  confidentiality, integrity, or availability of the end-system and the  information it contains. This in turn can adversely affect an agency’s  ability to carry out its mission. Each of the key threats presented in table 1 could  create an unacceptable risk to federal agencies. Three National Security-Related Agencies Have Not Fully Addressed IT Supply Chain Risk

Although the four agencies in our review have acknowledged the risks  presented by supply chain vulnerabilities, two of the agencies—Energy  and DHS—have not yet defined supply chain protection measures for  department information systems and are not in a position to have  implementing procedures or monitoring capabilities to verify compliance  with and effectiveness of any such measures. Justice has identified  supply chain protection measures, but has not developed procedures for  implementing or monitoring compliance with and the effectiveness of  these measures. In contrast, Defense has made greater progress through  its incremental approach to supply chain risk management. National Security-Related Agencies Participate in Governmentwide Efforts to Address Supply Chain Security

The four national security-related agencies also participate in interagency  efforts to address supply chain security. These include participation in the  CNCI, development of technical and policy tools, and collaboration with  the intelligence community. Agencies Have Not Determined the Extent of Foreign- Developed IT Telecommunications Equipment, Software, or Services

Officials within the offices of the chief information officer at the  Departments of Energy, Homeland Security, and Defense, and the  Justice Management Division stated that their respective agencies have  not determined and do not currently track the extent to which their  telecommunications networks contain foreign-developed equipment,  software, or services. Until comprehensive policies,  procedures, and monitoring capabilities are developed, documented, and  implemented, it is more likely that these national security-related agencies  will rely on security measures that are inadequate, ineffective, or  inefficient to manage emergent information technology supply chain risks. To assist the Department of Homeland Security in protecting against IT  supply chain threats, we recommend that the Secretary of Homeland  Security direct the appropriate agency officials to take the following three  actions: develop and document departmental policy that defines which security  measures should be employed to protect against supply chain threats; develop, document, and disseminate procedures to implement the  supply chain protection security measures defined in departmental  policy; and develop and implement a monitoring capability to verify compliance  with, and assess the effectiveness of, supply chain protection  measures. Appendix I: Objectives, Scope, and Methodology

Our objectives were to identify (1) the key risks associated with the supply  chains used by federal agencies to procure information technology (IT)  equipment, software, or services; (2) the extent to which selected national  security-related agencies have addressed information technology supply  chain risks; and (3) the extent to which national security-related federal  agencies have determined that their telecommunication networks contain  foreign-developed equipment, software, or services.
Why GAO Did This Study

Federal agencies rely extensively on computerized information systems and electronic data to carry out their operations. The exploitation of information technology (IT) products and services through the global supply chain is an emerging threat that could degrade the confidentiality, integrity, and availability of critical and sensitive agency networks and data.
GAO was asked to identify (1) the key risks associated with the IT supply chains used by federal agencies; (2) the extent to which selected national security-related departments have addressed such risks; and (3) the extent to which those departments have determined that their telecommunication networks contain foreign-developed equipment, software, or services. To do this, GAO analyzed federal acquisition and information security laws, regulations, standards, and guidelines; examined departmental policies and procedures; and interviewed officials from four national security-related departments, the intelligence community, and nonfederal entities.

What GAO Found

Reliance on a global supply chain introduces multiple risks to federal information systems. These risks include threats posed by actorssuch as foreign intelligence services or counterfeiterswho may exploit vulnerabilities in the supply chain and thus compromise the confidentiality, integrity, or availability of an end system and the information it contains. This in turn can adversely affect an agencys ability to effectively carry out its mission. Each of the key threats could create an unacceptable risk to federal agencies.
Although four national security-related departmentsthe Departments of Energy, Homeland Security, Justice, and Defensehave acknowledged these threats, two of the departmentsEnergy and Homeland Securityhave not yet defined supply chain protection measures for department information systems and are not in a position to have implementing procedures or monitoring capabilities to verify compliance with and effectiveness of any such measures. Justice has identified supply chain protection measures, but has not developed procedures for implementing or monitoring compliance with and effectiveness of these measures. Until comprehensive policies, procedures, and monitoring capabilities are developed, documented, and implemented, it is more likely that these national security-related departments will rely on security measures that are inadequate, ineffective, or inefficient to manage emergent information technology supply chain risks. In contrast, Defense has made greater progress through its incremental approach to supply chain risk management. The department has defined supply chain protection measures and procedures for implementing and monitoring these measures. The four national security-related departments also participate in governmentwide efforts to address supply chain security, including the development of technical and policy tools and collaboration with the intelligence community.
Officials at the four departments stated that their respective agencies have not determined or tracked the extent to which their telecommunications networks contain foreign-developed equipment, software, or services. Federal agencies are not required to track this information, and officials from four components of the U.S. national security community believe that doing so would provide minimal security value relative to cost.

What GAO Recommends

GAO is recommending that the Departments of Energy, Homeland Security, and Justice take steps, as needed, to develop and document policies, procedures, and monitoring capabilities that address IT supply chain risk. These departments generally concurred with GAOs recommendations.