Each of the components of an  information system may rely on one or more supply chains—that is, the  set of organizations, people, activities, information, and resources that  create and move a product or service from suppliers to an organization’s  customers. Federal Laws and Guidelines Require the Establishment of Information Security Programs and Provide for Managing Supply Chain Risk

The Federal Information Security Modernization Act (FISMA) of 2014  requires federal agencies to develop, document, and implement an  agency-wide information security program to provide information security  for the information systems and information that support the operations  and assets of the agency. IT Supply Chains Introduce Numerous Information Security Risks to Federal Agencies

In several reports issued since 2012, we have pointed out that the  reliance on complex, global IT supply chains introduces multiple risks to  federal information and telecommunications systems. As we reported in March 2012, supply chain threats are present at  various phases of a system’s development life cycle. Key threats that  could create an unacceptable risk to federal agencies include the  following. Installation of counterfeit hardware or software, which is hardware  or software containing non-genuine component parts or code. Failure or disruption in the production or distribution of critical  products. Both man-made (e.g., disruptions caused by labor, trade,  or political disputes) and natural (e.g., earthquakes, fires, floods, or  hurricanes) causes could decrease the availability of material needed  to develop systems or disrupt the supply of IT products critical to the  operations of federal agencies. Reliance on a malicious or unqualified service provider for the  performance of technical services. Installation of hardware or software that contains unintentional  vulnerabilities, such as defects in code that can be exploited. We noted in the March 2012 report that threat actors can introduce  these threats into federal information systems by exploiting vulnerabilities  that could exist at multiple points in the global supply chain. Examples of the types of vulnerabilities that could be  exploited include acquisitions of IT products or parts from sources other than the  original manufacturer or authorized reseller, such as independent  distributors, brokers, or on the gray market;  lack of adequate testing for software updates and patches; and  incomplete information on IT suppliers. If a threat actor exploits an existing vulnerability, it could lead to the loss  of the confidentiality, integrity, or availability of the system and associated  information. Four National Security-Related Agencies Have Acted to Better Address IT Supply Chain Risks for Their Information Systems

In March 2012, we reported that the four national security-related  agencies (i.e., Defense, Justice, Energy, and DHS) had acknowledged  the risks presented by supply chain vulnerabilities. However, the  agencies varied in the extent to which they had addressed these risks by  (1) defining supply chain protection measures for department information  systems, (2) developing implementing procedures for these measures,  and (3) establishing capabilities for monitoring compliance with, and the  effectiveness of, such measures. Of the four agencies, the Department of Defense had made the most  progress addressing the risks. Specifically, the department’s supply chain  risk management efforts began in 2003 and included: a policy requiring supply chain risk to be addressed early and across  a system’s entire life cycle and calling for an incremental  implementation of supply chain risk management through a series of  pilot projects; a requirement that every acquisition program submit and update a  “program protection plan” that was to, among other things, help  manage risks from supply chain exploits or design vulnerabilities; procedures for implementing supply chain protection measures, such  as an implementation guide describing 32 specific measures for  enhancing supply chain protection and procedures for program  protection plans identifying ways in which programs should manage  supply chain risk; and a monitoring mechanism to determine the status and effectiveness of  supply chain protection pilot projects, as well as monitoring  compliance with and effectiveness of program protection policies and  procedures for several acquisition programs. Specifically, we recommended that Energy and DHS: develop and document departmental policy that defines which security  measures should be employed to protect against supply chain threats. We also recommended that Justice, Energy, and DHS: develop, document, and disseminate procedures to implement the  supply chain protection security measures defined in departmental  policy, and develop and implement a monitoring capability to verify compliance  with, and assess the effectiveness of, supply chain protection  measures. The three agencies generally agreed with our recommendations and,  subsequently, implemented seven of the eight recommendations. Nevertheless, the implementation of the seven  recommendations and partial implementation of the eighth  recommendation better positioned the three agencies to monitor and  mitigate their IT supply chain risks.
Why GAO Did This Study

IT systems are essential to the operations of the federal government. The supply chain—the set of organizations, people, activities, and resources that create and move a product from suppliers to end users—for IT systems is complex and global in scope. The exploitation of vulnerabilities in the IT supply chain is a continuing threat. Federal security guidelines provide for managing the risks to the supply chain.
This testimony statement highlights information security risks associated with the supply chains used by federal agencies to procure IT systems. The statement also summarizes GAO's 2012 report that assessed the extent to which four national security-related agencies had addressed such risks. To develop this statement, GAO relied on its previous reports, as well as information provided by the national security-related agencies on their actions in response to GAO's previous recommendations. GAO also reviewed federal information security guidelines and directives.

What GAO Found

Reliance on a global supply chain introduces multiple risks to federal information systems. Supply chain threats are present during the various phases of an information system's development life cycle and could create an unacceptable risk to federal agencies. Information technology (IT) supply chain-related threats are varied and can include:
installation of intentionally harmful hardware or software (i.e., containing “malicious logic”);
installation of counterfeit hardware or software;
failure or disruption in the production or distribution of critical products;
reliance on malicious or unqualified service providers for the performance of technical services; and
installation of hardware or software containing unintentional vulnerabilities, such as defective code.
These threats can have a range of impacts, including allowing adversaries to take control of systems or decreasing the availability of materials needed to develop systems. These threats can be introduced by exploiting vulnerabilities that could exist at multiple points in the supply chain. Examples of such vulnerabilities include the acquisition of products or parts from unauthorized distributors; inadequate testing of software updates and patches; and incomplete information on IT suppliers. Malicious actors could exploit these vulnerabilities, leading to the loss of the confidentiality, integrity, or availability of federal systems and the information they contain.
GAO reported in 2012 that the four national security-related agencies in its review—the Departments of Defense, Justice, Energy, Homeland Security (DHS)—varied in the extent to which they had addressed supply chain risks. Of the four agencies, Defense had made the most progress addressing the risks. It had defined and implemented supply chain protection controls, and initiated efforts to monitor the effectiveness of the controls. Conversely, Energy and DHS had not developed or documented policies and procedures that defined security measures for protecting against IT supply chain threats and had not developed capabilities for monitoring the implementation and effectiveness of the measures. Although Justice had defined supply chain protection measures, it also had not developed or documented procedures for implementing or monitoring the measures.
Energy and Justice fully implemented the recommendations that GAO made in its 2012 report and resolved the deficiencies that GAO had identified with their supply chain risk management efforts by 2016. DHS also fully implemented two recommendations to document policies and procedures for defining and implementing security measures to protect against supply chain threats by 2015, but could not demonstrate that it had fully implemented the recommendation to develop and implement a monitoring capability to assess the effectiveness of the security measures.

What GAO Recommends

In its 2012 report, GAO recommended that Justice, Energy, and DHS take eight actions, as needed, to develop and document policies, procedures, and monitoring capabilities that address IT supply chain risk. The departments generally concurred with the recommendations and subsequently implemented seven recommendations and partially implemented the eighth recommendation.