FERC SCRM Conference Announcement

Some people have raised some really good questions, which I will attempt to answer here, based on my experiences implementing Cyber Supply Chain Risk Management practices since 2018 to support FERC Order 850.

Q1: What are the steps to "validate the completeness and accuracy of information received from vendors during the procurement process":

A1: SCRM best practices supplied by "NIST Guidance", per OMB M-22-18 and NIST SP 800-161r1, and CISA Secure Software Acquisition Guide suggest that consumers apply risk assessment functions to examine vendor viability, integrity, trustworthiness and foreign ownership, influence and control. Similar risk assessment functions also apply to vendor software development and manufacturing practices, support and trustworthiness for products available to consumers. This requires that a vendor/supplier provide a customer, or prospective customer with "specific attestation information" needed to perform these detailed risk assessment functions and frequently includes Financial and Ownership attestations, Cybersecurity Practices Attestations, Employee hiring, retention practices and ongoing educational activities and the locations where products are developed and manufactured to ensure that secure, trustworthy products are created, distributed and supported. 

Product level attestations are also required to be supplied to customers and prospective customers, including SBOM's, HBOM's, Vulnerability Disclosure Reports (VDR), Security Advisories (SA), Coordinated Vulnerability Disclosure (CVD) practices, Secure Software Development Life Cycle (SDLC) practices and controls used during product development, manufacturing, distribution and support practices including End of Life plans and cybersecurity protections applied to the development, manufacturing, testing and distribution environments and processes. The combined set of attestations for vendor and product risk assessments must be supplied to a consumer in order to perform a comprehensive risk assessment resulting in a "Product Trust Score" that factors in all of the attestation materials and risk analysis performed. A Vendor Response File provides access to these attestation artifacts.

The software industry has also announced support for new legislation requiring Federal Contractors to implement NIST Vulnerability Disclosure Reporting practices.

Completeness of these attestations is defined by the consumer. Vendors are expected to provide the complete set of attestation materials required by the Consumer, a Vendor Response File (VRF) may be used for this purpose. Consumers are expected to perform a comprehensive risk assessment and "integrity check validation" based on the attestation materials provided and any additional information that the consumer may receive from a vendor. The US Coast Guard is planning to maintain a "Trust Registry" of approved products that can be installed in US Coast Guard IT and OT systems on land and sea. A Trust Registry is a very effective and efficient method to share product risk assessment results across US Government Agencies, critical infrastructure sectors and the public. NASA also provides vendors with detailed instructions to complete the NASA SCRM risk assessment process.

In summary, completeness expectations are defined by the consumer, usually in the form of specific attestation material requirements. Validation is performed by the Consumer using their own risk profile and expectations for integrity, trustworthiness and overall vendor and product longevity and viability using the attestation materials provided by a vendor. Corroborating evidence is frequently used during validation activities.