Supply Chain Security Assessment

A supply chain security assessment is an evaluation of the security risks that come from what a buyer is procuring and from the vendors, subcontractors, suppliers and other third parties that may provide it. The buyer uses the results to decide which measures will prevent or mitigate risks to the integrity, confidentiality, availability and continuity of the goods or services. The Government of Canada sets out this approach in its guidance Supply Chain Security – Assessing Your Risk Profile.

The concept comes from supply chain risk management and from cyber, information, industrial and defence security. It looks at the full chain of provision, including manufacturing, transportation, integration, operation, ownership and third-party relationships. The Canadian Centre for Cyber Security uses the exact phrase "supply chain security assessment" in its recommended cyber security contract clauses for cloud services.

The three stages of a Canadian supply chain security assessment

Federal guidance treats the assessment as a staged procurement activity. Each stage builds on the one before it.

• Assess the good or service. The buyer first looks at the security risk in what is being procured. The guidance states that a supply chain security risk can be present in any procurement process, regardless of cost.
• Assess the vendors. The buyer then assesses the risks tied to its expected pool of vendors, including their subcontractors and supply chains. Access to sensitive information is a key factor, including access to organizational ICT infrastructure, sensitive data and metadata.
• Select mitigation measures. The buyer chooses controls or other measures to address the risks identified in the first two stages.

The security considerations depend on what is being procured and on the access the vendor or its subcontractors would have. The same source is available on science.gc.ca.

What cloud and ICT contracts ask suppliers to provide

The clearest Canadian procurement use of the assessment is in federal cloud services and other information and communications technology. The Cyber Centre recommends that organizations conduct supply chain risk assessments during cloud procurement. It also recommends that they ask cloud service providers about their supply chain risk management plans, ownership, subsidiaries and third-party relationships.

The recommended clauses place several duties on the contractor:

• Provide the information the customer needs for its assessment, including ownership structure, corporate registration, investors and management executives.
• Identify suppliers, subcontractors, sub-processors and other third-party relationships.
• Provide information about equipment, firmware, software and other systems relevant to the assessment.
• Maintain a supply chain risk management plan that explains how the contractor will reduce and mitigate supply chain risks.

How NATO treats supply chain security

NATO places supply chain security within broader defence-industrial resilience and is developing mechanisms for sharing supply chain assessments among Allies. Its Defence Critical Supply Chain Security Roadmap factsheet describes this work. NATO procurement material also refers to supplier self-attestation, internal audit processes and periodic independent assessments against supply chain security practices, as set out in the NCIA supply chain security requirements document.

Related terms

• Supply chain risk assessment
• Supply chain risk management (SCRM)
• Security of supply
• Cyber supply chain risk
• Vendor, subcontractor, sub-processor and third-party risk

What it means for a supplier bidding on Canadian public contracts

Expect the buyer to assess your company as well as your product. On cloud and ICT bids, be ready to document who owns the company, who invests in it and who manages it. Be ready to name the subcontractors, sub-processors and other third parties in your chain, and to describe the equipment, firmware and software you rely on. Prepare a supply chain risk management plan before the solicitation closes, because contracts can require you to maintain one. The depth of review depends on what is being bought and what access you would have to sensitive systems and data, so read the security clauses in each solicitation closely.