How to Manage Risk Along the Federal Government Supply Chain 

The U.S. federal government relies on an ever-expanding supply chain of tens of thousands of contractors and subcontractors to provide critical services, hold and maintain sensitive data, and perform key functions. While this supply chain is essential to agencies’ fundamental operations, it also increases the number of access point nefarious actors have to their systems and data and, consequently, puts agencies and sensitive data at greater risk.

Even the most sophisticated federal agencies have found it difficult to effectively measure and evaluate the cyber risk of their contractor base. For example, the Navy recently released a report that highlighted growing concerns around supply chain cybersecurity, noting that the federal supply chain has been “compromised in ways and to an extent yet to be fully understood.” In a July 2019 report on the security of its contractors, the Defense Department Inspector General was blunt: The department “does not know the amount of DOD information managed by contractors and cannot determine whether contractors are protecting unclassified DOD information from unauthorized disclosure.”

In fact, data suggests that contractors are not meeting agency expectations for security. Recent BitSight research found that the average security performance rating across all federal agencies was at least 15 points higher than the mean security performance rating of any contractor sector. In other words, there is a significant security performance gap between federal agencies and their supply chain partners.

The time has come for agencies to prioritize this critical risk in their cybersecurity programs. There are steps agencies can take to more effectively measure, monitor and manage this challenge. 

Put Someone in Charge

Agency leadership must ensure that their contractors and vendors are protecting the sensitive government data with which they have been entrusted. Political, technology and civil service leaders within an agency all must be involved in addressing this risk. 

Agencies should assign positions dedicated to reducing contractor cyber risk and provide appropriate budget and resourcing to accomplish this mission. The Defense Department may provide a strong model here, recently creating a new Chief Information Security Office under the Assistant Secretary of Defense for Acquisition. This is an important development because it vests responsibility with a senior official with a budget to match.

Identify Issues Before You Engage

When determining whether to engage with a contractor, it is imperative that agencies collect critical details about the organization's security posture and areas of risk. This isn’t just about collecting responses to a questionnaire—that’s subjective and qualitative data and does not give a real-time picture into the risk. Agencies can enlist the help of continuous diagnostic assessments of the contractor’s IT system to monitor for risks over the course of the assessment process.

The initial assessment should be used as a baseline measure of strengths and areas that indicate the potential for increased vulnerability and, therefore, dictate whether or not to engage. For example, BitSight research has found that poor response to botnet infections is an indicator of poor overall security posture.

Continuously Monitor and Collaborate with Contractors

Once an agency identifies and onboards a contractor, the real risk begins. Federal agencies should seek capabilities that allow them to have continuous visibility into security performance issues of their contractor base. 

But beyond visibility, agencies must develop ways to interact with their contractor base if they spot an indicator of poor security performance. For example, the BitSight report found that nearly 20% of technology and aerospace/defense employees who contract for the federal sector use an outdated internet browser. This can expose agencies to sophisticated forms of malware and bots that take advantage of vulnerabilities like Spectre, which exploited outdated browsers to attack or compromise data.

Collaborating with a contractor or subcontractor who may be at risk of experiencing such an incident must be a critical priority for agency leads. By providing data in a collaborative way, they can reduce the likelihood that a contractor loses sensitive agency or citizen data. 

Map Out and Plan for Outages and Breaches in Common Service Providers

A severe disruption affecting technology service providers could have a widespread impact on U.S. government contractors and subcontractors. In addition to achieving greater oversight of the cyber risk posed by contractors, it will be critical for the U.S. government to also understand how risk may also trickle down from common vendors, platforms, and technologies used by contractors themselves.

For example, many entities within the network of federal contractors leverage service providers who own hosting, email and domain name system. Given this crossover, a compromise or outage within these providers would likely impact many federal agencies at once, including an operational impact on its agency customers, and damage those agencies’ overall cybersecurity. It’s critical that federal agencies have a firm grasp about these dependencies and plan for possible disturbances accordingly.

Leverage Tools to Take on this Challenge 

Leveraging vast network of contractors and subcontractors is a necessary part of keeping federal agencies running smoothly and efficiently but puts our government at increased risk of a cyber incident. By proactively managing cyber risk as a joint responsibility between the agency and the vendor, including implementing policies around continuous monitoring and ongoing collaboration, agencies will position themselves to better protect their data, networks and systems from falling into the wrong hands.

Jake Olcott is vice president at BitSight and an adjunct professor at Georgetown University. He served as cybersecurity attorney to the Senate Commerce Committee and House Homeland Security Committee.