Cyber Supply Chain Risk Management (C-SCRM)

Modern systems are assembled from other parties' products: software libraries, cloud services, managed providers, chips and updates. An attacker who cannot break into the target may instead compromise a supplier and arrive through a trusted route. The practice starts with knowing what the organisation depends on, including suppliers of suppliers. It then rates how critical each one is, checks their security before and during the contract, and writes requirements into agreements, such as breach notice and the right to audit. For software, buyers increasingly ask for a bill of materials listing the components inside a product. Monitoring and an exit or substitution plan finish the cycle. It overlaps with general third-party risk work but looks specifically at how a supplier could become an attack path. One poisoned update from a single supplier can reach thousands of customers at the same moment.

A university timetabling product is built on an open-source library. When a serious flaw in that library is announced, the IT security team checks the vendor's component list, finds the library inside, demands a patch date, and puts extra network monitoring around the system until the fix is installed.