Dod Supply Chain Risk Management Plan

Standard Operating Procedure: DoD Supply Chain Risk Management (SCRM)

1. Document Control Block

---

2. Executive Summary & Scope

This SOP defines the institutional protocol for identifying, assessing, and mitigating risks within the Department of Defense (DoD) supply chain. It adheres to NIST SP 800-161 (Rev 1) and DoDI 5200.44 regarding the protection of mission-critical functions. The scope covers the entire lifecycle of hardware/software procurement, from vendor vetting to decommissioning, ensuring the integrity of the Cybersecurity Maturity Model Certification (CMMC) requirements.

---

3. Prerequisites & Tool Requirements

• Systems Access: Access to the Supplier Performance Risk System (SPRS), Joint Federated Assurance Center (JFAC) portal, and CMMC eMASS instance.
• Certifications: Personnel must maintain active DoD 8570 baseline security certifications (IAM Level II or equivalent).
• Tools:
  • SCRM Analytics Dashboard (Internal Integration Layer).
  • Automated Software Bill of Materials (SBOM) verification tool (e.g., CycloneDX/SPDX scanners).
  • Foreign Ownership, Control, or Influence (FOCI) vetting software.

---

4. Roles & Responsibilities (RACI Matrix)

---

5. Step-by-Step Operational Procedure

Phase 1: Supplier Vetting & Due Diligence

• Conduct FOCI screening to ensure no prohibited source entities under Section 889 of the NDAA.
• Validate SPRS score against the minimum required threshold for the current contract tier.
• Request and audit the vendor’s Software Bill of Materials (SBOM) for all integrated components.

Phase 2: Threat Assessment & Risk Quantification

• Cross-reference product component lineage against the DoD Trusted Foundry list.
• Run automated vulnerability scans (CVE matching) on all firmware/hardware logic provided by the vendor.
• Calculate the "Risk Score" based on: Threat Probability x Impact on Mission Readiness.

Phase 3: Mitigation & Continuous Monitoring

• Document specific mitigation plans for identified risks (e.g., air-gapping, supply chain path diversification).
• Configure telemetry/alerts for real-time tracking of vendor operational shifts.
• Schedule quarterly re-verification of the vendor's cybersecurity compliance status.

---

6. Quality Assurance & Verification Criteria

• Audit Checklist:
  • Is the SPRS score verified within the last 30 days?
  • Does the current SBOM map 100% to the delivered hardware?
  • Is the mitigation plan documented with an assigned Owner and Deadline?
• Tolerance Thresholds:
  • Critical Vulnerability (CVSS > 9.0) = Immediate Hold.
  • Unverified FOCI status = Automatic Disqualification.
• Acceptance Benchmark: 0% high-severity unmitigated findings across all Tier 1 components.

---

7. Practical Troubleshooting Scenarios

Scenario A: Unauthorized Component Sub-vendor Identified

• Detection: SBOM analysis reveals a sub-component sourced from a prohibited geography.
• Protocol:
  1. Quarantine shipment immediately.
  2. Issue "Stop Work" order to the primary vendor.
  3. Initiate formal inquiry requiring vendor to provide documented proof of component replacement or technical justification for parity.

Scenario B: Vendor SPRS Score Drops Below Threshold

• Detection: Automated monitoring alerts of a breach or compliance lapse in the vendor's internal network.
• Protocol:
  1. Trigger 72-hour grace period for vendor remedial action.
  2. If not rectified, suspend procurement lifecycle and initiate secondary sourcing protocol from the pre-vetted contingency vendor list.

---

Julian Vance Chief Operations Architect Template Registry