Trump Orders New Defense Supply-Chain Rules Covering Software
Summary
An executive order directs the Department of War to develop rules requiring defense contractors to map suppliers and software dependencies, vet suppliers, and report significant supply-chain risks. The resulting maps could themselves become security targets.
Key points
- The order directs the Secretary of War to develop supply-chain policies within 180 days, with implementing regulations due within 90 days after the policies are completed.
- Proposed requirements would cover prime contractors and potentially subcontractors at every level, including software, cloud, and managed-service providers.
- Contractors would submit an “indentured Bill of Materials” tracing software, firmware, equipment, suppliers, and materials through the supply chain.
- Supplier reviews would consider financial stability, foreign ownership or influence, and manufacturing and supply risks.
- Significant risks identified through supplier vetting would be reported within 15 days; a corrective action plan would be due within 45 days. The 15-day deadline is not a general cyber incident reporting requirement.
- Detailed supply-chain maps could expose dependencies and bottlenecks if compromised; the article recommends access controls, encryption, audit logging, data loss prevention, and compartmentalization.
- The order directs the Department of War to use AI to analyze acquisition information for vulnerabilities, bottlenecks, and single points of failure.
Article Details
- Event Type
- Executive order establishing forthcoming defense supply-chain mapping and security rules
- Impact
- The order directs the Department of War to develop policies requiring defense contractors, potentially including subcontractors at every tier, to map critical supply chains and vet suppliers. Planned requirements include supply-chain documentation, risk mitigation and reporting, with rules due after the policies are completed. The order also raises cybersecurity concerns because detailed supply-chain data could expose dependencies and bottlenecks if compromised. The scope and implementation depend on forthcoming regulations.