GAO slams federal agencies for IT supply chain risk

Federal agencies don't understand where their technology comes from

Man in suit in front of holographic display showing risk assessment and supply chain

Just days after the US government learned of a widespread hack via a third-party provider's software, the US Government Accountability Office (GAO) has issued a report criticizing 23 civilian agencies for poor risk management in their information and communications technology (ICT) supply chains.

The GAO report, “Federal Agencies Need to Take Urgent Action to Manage Supply Chain Risks,” examined how federal government agencies managed risks from third-party hardware, software, and services. It examined multiple organizations, including the Departments of Agriculture, Commerce, Education, and Energy. The Office of Personnel Management, which suffered a massive data breach in 2015, was also in the review.

"Over several years, we have reported that the growing dependence on a globally distributed supply chain — and the lack of control over and visibility into how ICT products and services are developed, integrated, and deployed — presents an increasing amount of risk to federal agencies," the report warned.

It identified ICT supply chain risks, including the introduction of counterfeit products and the compromise of legitimate ones before delivery.

"Threat actors attack all tiers of the supply chain and at each phase of the system development life cycle and, thus, pose significant risk to federal agencies," it continued.

Auditors examined how agencies implemented seven foundational supply chain risk management (SCRM) practices, including executive oversight, creating an agency-wide strategy, and creating SCRM requirements for suppliers.

"None of the 23 agencies fully implemented all of the SCRM practices and 14 of the 23 agencies had not implemented any of the practices," it warned, highlighting the security risks involved.

Not a single agency had established a process to conduct agency-wide ICT supply chain risk assessments, and 19 of them had no method to document their ICT supply chains.

Agencies complained they had no federal guidance on SCRM, the report noted. A federal organization dedicated to managing supply chain risk, the Federal Acquisition Security Council, was scheduled to issue guidance this month.

However, the National Institute of Standards and Technology (NIST) already issued SCRM guidance in 2015 and updated its cyber security framework to cover supply chain risk in April 2018, the report noted. The Office of Management and Budget (OMB) required agencies to tackle SCRM since 2016.

The GAO made 145 recommendations to the agencies, including making someone responsible for leading agency-wide SCRM activities and creating a strategy to secure ICT supply chains. Seventeen agencies agreed with all the recommendations, but one unidentified organization agreed with none.

Already released privately in October, the report's public release came in the wake of a widespread government hack. Attackers compromised several government departments via the SolarWinds IT monitoring system in a hack so serious the FBI, CISA, and the ODNI coordinated a government-wide response. 

Some of the government departments compromised in the attack, including the Department of the Treasury, Department of Commerce, and Homeland Security, were among those covered in the GAO report.

Featured Resources

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Evaluate your order-to-cash process

15 recommended metrics to benchmark your O2C operations

Download now

AI 360: Hold, fold, or double down?

How AI can benefit your business

Download now

Getting started with Azure Red Hat OpenShift

A developer’s guide to improving application building and deployment capabilities

Download now

Recommended

NSA issues guidance on encrypted DNS usage
Domain Name System (DNS)

NSA issues guidance on encrypted DNS usage

15 Jan 2021
Pentagon pauses $2 billion cyber security project
Policy & legislation

Pentagon pauses $2 billion cyber security project

14 Jan 2021
White House launches AI Initiative Office
Policy & legislation

White House launches AI Initiative Office

13 Jan 2021
FCC won't review Section 230 before Biden takes over
Policy & legislation

FCC won't review Section 230 before Biden takes over

11 Jan 2021

Most Popular

IT retailer faces €10.4m GDPR fine for employee surveillance
General Data Protection Regulation (GDPR)

IT retailer faces €10.4m GDPR fine for employee surveillance

18 Jan 2021
Citrix buys Slack competitor Wrike in record $2.25bn deal
collaboration

Citrix buys Slack competitor Wrike in record $2.25bn deal

19 Jan 2021
Should IT departments call time on WhatsApp?
communications

Should IT departments call time on WhatsApp?

15 Jan 2021