Dod Supply Chain Risk Management Plan Template

Standard Operating Procedure: DoD Supply Chain Risk Management (SCRM) Plan Development

Document Control Block

• Document ID: TR-SCRM-DOD-2024-001
• Effective Date: 2024-05-22
• Version: 2.1.0
• Review Cadence: Annual or upon major DFARS/NIST SP 800-161 revision
• Target Audience: Supply Chain Managers, Program Security Officers (PSO), Cybersecurity Architects, Procurement Leads

---

1. Executive Summary & Scope

This SOP defines the standardized framework for developing, documenting, and maintaining a Supply Chain Risk Management (SCRM) Plan compliant with DoD Instruction 5200.44 and NIST SP 800-161 (Rev 1). This procedure governs all critical components within the DoD acquisition lifecycle, ensuring the integrity, security, and resiliency of hardware, software, and services against adversarial exploitation, counterfeiting, and unintended vulnerabilities.

---

2. Prerequisites & Tool Requirements

• Access Credentials: CAC/PIV authentication for access to CMMC/STIG repositories.
• Software/Systems: Access to the Supplier Performance Risk System (SPRS), PDREP (Product Data Reporting and Evaluation Program), and Enterprise Resource Planning (ERP) risk modules.
• Regulatory Foundation: Comprehensive familiarity with DFARS Clause 252.246-7007 and 252.246-7008.
• Certifications: Personnel should ideally hold supply chain security professional credentials (e.g., CISSP, CPSM).

---

3. Roles & Responsibilities (RACI Matrix)

---

4. Step-by-Step Operational Procedure

Phase I: Criticality & Threat Assessment

• Identify all Program Critical Components (PCC) using the Program Protection Plan (PPP).
• Execute a threat landscape analysis against Tier 1 and Tier 2 suppliers.
• Map the Bill of Materials (BOM) to identify high-risk geographic origins and sub-tier dependencies.

Phase II: Mitigation & Control Implementation

• Establish "Trusted Source" validation protocols for all Tier 1 suppliers.
• Draft physical and logical access controls for the transit and storage of critical assets.
• Configure automated real-time monitoring of supplier financial, operational, and cybersecurity health.

Phase III: Continuous Monitoring & Review

• Conduct quarterly "SCRM Deep Dives" using SPRS data to identify emerging vulnerabilities.
• Implement an automated trigger for "Supply Chain Incident Response" (SCIR) upon notification of a new CVE impacting the supply chain.
• Perform annual audit of the plan against current DoD cyber-supply chain directives.

---

5. Quality Assurance & Verification Criteria

• Verification Benchmark 1: 100% of critical components must have a verified "chain of custody" documented within the SCRM registry.
• Verification Benchmark 2: Supplier risk scores must be refreshed within the ERP system every 30 days.
• Tolerance Threshold: Zero tolerance for "Unverified/Unknown" origin sources for any Component identified as "Critical" or "Mission-Essential."
• Audit Checklist:
  • Does the current plan match the active BOM?
  • Have all critical suppliers signed the updated Cyber-Security Addendum?
  • Are all identified risks assigned a specific mitigation strategy?

---

6. Practical Troubleshooting Scenarios

Scenario A: Key Supplier Declared "High Risk" by SPRS

• Action: Immediately initiate a "Quarantine Protocol" on all incoming deliveries from said supplier. Consult with the Program Security Officer (PSO) to determine if a secondary source is available. Evaluate the necessity of a formal "SCRM Waiver" if no alternative source exists.

Scenario B: Discovery of Counterfeit Part in Inventory

• Action: Cease all production lines utilizing the affected component class. Report the incident via PDREP within 24 hours per DFARS 252.246-7007. Initiate a mandatory, documented visual and forensic audit of all inventory lots associated with the suspect supplier.

Scenario C: Supplier Data Breach/Cyber Incident

• Action: Trigger the Cybersecurity Incident Response Plan. Suspend automated data exchange with the supplier’s ERP interface until an Attestation of Remediation is verified. Conduct a blast-radius analysis to determine if the compromised supplier had access to system specifications or controlled technical data.

---

Authored by: Julian Vance, Chief Operations Architect, Template Registry.