Supply Chain Risk Management
Securing the Supply Chain for Information and Communications Technology is critical to the security of any organization.
Governance
Supply Chain Governance is attentive to the system from end-to-end, and the interaction of the points in between. The primary focus is a set of policies, processes, and procedures defining how procurement decisions are made and implemented a framework where these decisions can be made. Supply chain governance is a strategic approach regarding the mechanisms used by different actors from within the supply chain to influence and or control the actions of other supply chain partners.
There are many governance models some simple some complex depending on the size and needs of the organization. The simple model below rests on a solid pyramid Tier 1) defining and designating the responsibility for shaping corporate strategy based on requirements and tuned to include ethics, culture, values; Tier 2) clear guidelines demarcating responsibilities for the development of implementable policies, processes, procedures, including decision making and issue escalation; Tier 3) implementation of the policies, procedures and their monitoring and enforcement.
This table from NIST Special Publication 800-161 Chapter 2 Page 18 summarizes typical responsibilities by tier.
| Table 2-1: Supply Chain Risk Management Stakeholders | |||
|---|---|---|---|
| Tiers | Tier Name | Generic Stakeholder | Activities |
| 1 | Organization | Executive Leadership (CEO, CIO, COO, CFO, CISO, CTO, etc.) - Risk executive | Define corporate strategy, policy, goals and objectives |
| 2 | Mission | Business Management (includes program management (PM), research and development (R&D), Engineering [SDLC oversight], Acquisitions / Procurement, Cost Accounting, reliability, safety, security, and quality, management | Develop actionable policies and procedures, guidance and constraints |
| 3 | Information Systems | Systems Management (architect, developers, system owner, QA/QC, test, contracting personnel (approving selection, payment and approach for obtaining, maintenance engineering, disposal personnel, etc.) | Policy implementation, requirements, constraints, implementations |
Among the goals of the development of actionable governance policies (procedures/processes) based on defined corporate strategy are: streamline and manage supplier quality, performance and reduction of fraud, streamline internal supply chain activities, ensure supplier compliance to laws and regulations, enhance vendor involvement, optimizing use of internal resources. Those suppliers who actively embrace and participate in the customers governance process become Trusted Vendors.
- A supply chain policy should have a first and last activity (a supplier and a customer) characterized by repeated activities between, thus forming a network that creates value for the customer.
- The policy should have a clearly defined purpose such as why it is mandatory for all suppliers to apply verifying irremovable markings codes to their product.
- A policy should have a scope that clearly describes what is and is not covered by the details within.
- A policy should be coordinated with all stakeholders (internal and external) and approved. External stakeholders who do not approve or are unwilling to abide by the proposed policy may be replaced if feasible.
- A policy should be well documented and communicated to all stakeholders.
- A policy should have a means for arbitration and resolution for non-compliance.
- A policy should be monitored, metrics applied, and reviewed often to determine if it is still viable or should be improved or replaced.
When implementing supply chain policies there is the potential for conflict with internal customers and external providers that should be anticipated and planned for: Internal resistance to a change in old procedures or the adoption of new ones; belief that they are different; requests for high customizations of the policy to meet perceived needs. External resistance to the readiness, desire or capability to take on new procedures; allowance for no customizations or exceptions of policy to fit their environment; addition of new and onerous tasks such as increased of more detailed reporting.
In conclusion, the creation and implementation of a supply chain governance system is not an easy task. It requires the full participation and cooperation of the C-Suite and all impacted stakeholders. But the advantage of a well-designed and implemented governance structure will smooth supply chain management, reduce problems, decrease risk and increase security.
