Cybersecurity

GAO calls out agencies for IT supply chain risks

quality assurance (Song_about_summer/Shutterstock.com) 

A government watchdog says federal civilian agencies are largely failing to appropriately manage supply chain risks associated with information and communications technology.

Congress asked the Government Accountability Office to review the extent to which 23 federal agencies are implementing best practices for supply chain risk management. To do that, GAO compiled seven practices from the National Institutes of Standards and Technology's guidance and compared them to current policies.

"None of the 23 agencies fully implemented all of the [supply chain risk management] practices and 14 of the 23 agencies had not implemented any of the practices," according to the report.

GAO cites a September 2019 report from the Cybersecurity and Infrastructure Security Agency that found that federal agencies face "approximately 180 different ICT supply chain-related threats."

The watchdog made more than 140 recommendations to the 23 CFO agencies, according to the new report, which is edited for public consumption compared to a sensitive version delivered to lawmakers in October.

The majority, 17 agencies, agreed with those recommendations, while the rest either partially agreed or disagreed as well as one agency that had no comment.

While the timing of the report's release is coincidental, GAO's warnings about supply chain risk comes while the federal government is responding to a cybersecurity attack in which hackers used a backdoor vulnerability in SolarWinds IT management software suite to breach multiple government networks.

About the Author

Justin Katz covers cybersecurity for FCW. Previously he covered the Navy and Marine Corps for Inside Defense, focusing on weapons, vehicle acquisition and congressional oversight of the Pentagon. Prior to reporting for Inside Defense, Katz covered community news in the Baltimore and Washington D.C. areas. Connect with him on Twitter at @JustinSKatz.

Featured

  • Workforce
    Avril Haines testifies SSCI Jan. 19, 2021

    Haines looks to restore IC workforce morale

    If confirmed, Avril Haines says that one of her top priorities as the Director of National Intelligence will be "institutional" issues, like renewing public trust in the intelligence community and improving workforce morale.

  • Defense
    laptop cloud concept (Andrey Suslov/Shutterstock.com)

    Telework, BYOD and DEOS

    Telework made the idea of bringing your own device a top priority as the Defense Information Systems Agency begins transitioning to a permanent version of the commercial virtual remote environment.

Stay Connected