Ask the CIO
CIO News
Open Data/Transparency
DoD Reporter's Notebook
On DoD
Defense Industry
Workforce/Management
Agency Oversight
Facilities/Construction
Hiring/Retention
Workforce Rights/Governance
Mike Causey
Tom Temin
Amtower Off-Center
Ask the CIO Podcasts
Business of Government Hour
CyberChat
Essentials of Healthy Living
Every Side of Cyber
Fed Access
Federal Drive
Federal Executive Forum
Federal Newscast
Federal Tech Talk
FEDtalk
Foodie and the Beast
For Your Benefit
Innovation in Government
IT Innovation Insider
Leaders and Legends
Market Chat
Of Consuming Interest
On DoD Podcasts
Platform for the Mission
Search for Accountability
Stratford University's Tech Talk
What's Working in Washington
Federal Insights
On Air: The Jim Bohannon Show
Air Force voluntary separation
Army creating robots with muscles
IT upgrades "urgent"
Listen Live Sports
Hubbard Radio Washington DC, LLC. All rights reserved. This website is not intended for users located within the European Economic Area.
FedInsights by RSA Archer
Protecting the supply chain to promote operational resiliency
By Jason Miller
The way we look at this is the risk footprint that an agency has, has expanded significantly and the importance, based on a lot of the nation state cyber criminals that are out there, to make sure that everybody in that expanded risk footprint is doing the best they can to secure those environments.
Dan Carayiannis
Director, Public Sector, RSA Archer
Operational Resiliency
Just establishing a supplier catalog is a basic start. From there, I could evolve to requiring those contractors to provide me information, maybe from automated tools or vulnerability scanning tools and highlight and attach that document to that particular vendor. Another area where we have seen where people have leveraged technologies and capabilities is independent virtual assessments of a third party contractor to see how secure they are from a public-facing perspective. There are a lot of different things we have seen agencies do where they are starting to leverage technology and tools. It's an evolutionary thing, it's a crawl, walk and run process.
Without a doubt, 2020 will be remembered in the federal sector as the year of supply chain risk management. Oh yeah, there's also the coronavirus pandemic turning everyone's world upside down.
But if we step back from this tragedy, we can see just how much attention and resources went to supply chain risk management over the last 12 months.
From the Defense Department's somewhat challenging roll out of the Cybersecurity Maturity Model Certification (CMMC) to the launch of the Federal Acquisition Security Council to the second part of the Section 889 acquisition rule, at every turn there agencies and vendors faced new requirements.
The task is so great that the Office of the Director of National Intelligence outlined three broad goals to improve the security of the federal supply chain. These include implementing enhanced capabilities to detect and respond to supply chain threats and more outreach to public and private sector partners about potential and real vulnerabilities.
Nearly every agency from ODNI to the FBI to DHS to the Commerce Department is involved in protecting the federal supply chain.
Agencies need to take all this data—both from public and private sector sources—and apply it to their specific mission areas.
Dan Carayiannis, the director of public sector at RSA, said the increasing concern about technology products and components, and whether the technology suppliers understand and have transparency into the chain of custody created a wake-up call of sorts for public and private sector organizations.
"The way we look at this is the risk footprint that an agency has, has expanded significantly and the importance, based on a lot of the nation state cyber criminals that are out there, to make sure that everybody in that expanded risk footprint is doing the best they can to secure those environments," Carayiannis said on the Innovation in Government show sponsored by Carahsoft.
The change in expectations and oversight is highlighted by initiatives such as the CMMC program as well as the Defense Industrial Base Cyber Assessment Center (DIBCAC) effort.
Carayiannis said CMMC, and soon DIBCAC, is pushing vendors to move beyond self-assessments and mandating certain controls and practices to increase the level of secure to address the expanded risk ecosystem.
"The pandemic has caused every agency to modify their thinking about their remote workforces, including the contractor community," Carayiannis said. "I think the pandemic has opened people's eyes to how organizations can operate in a more flexible, virtual environments, but also understanding the risks around that and therefore needing to put new security controls, processes, procedures and privacy standards in place to make sure they are doing that in a proper fashion."
He said RSA hears from DoD and civilian agencies about CMMC and what it may mean for their industry partners especially as they realize that how employees and industry partners work has permanently changed and therefore so has their cyber risk profiles and footprint.
"We have or years been supporting agencies and the contractor community in the way they manage their supply chains. Anything from putting in place an application to track their supply chain community, a supplier catalog, not just the individual organizations, but maybe the contracts they may have in place or the technologies they acquire from them," he said. "What the pandemic really did was cause people to reflect in a quick way not just on themselves but understanding the reliance they have on their contractors and suppliers. It got them to think through this concept of operational resiliency to ensure they are continuing business as usual."
Carayiannis said the need for operational resiliency also caused vendors to apply zero trust principles to address the increased risk ecosystem.
"We have seen agencies moving quickly to deploy software solutions where they are tracking, monitoring and requiring their supplier community to attest and demonstrate they are secure on an ongoing basis. They have controls in place, processes, practices and procedures to do this," he said. "We are able to do that using technology today where we are able to drive controls, be able to pull in information and be able to help contractors show a government organization that the following things are being done to protect the data or the technologies that they are providing are secure and there is a good chain of custody around those things."
Carayiannis said more agencies and vendors are using these automated tools to "trust but verify" their partners, especially as the pandemic changed the view of the cyber risk ecosystem.
To stand up a fully automated vendor management program, agencies must build piece-by-piece, including starting with data collecting and sharing that information across the agency.
"Just establishing a supplier catalog is a basic start. From there, I could evolve to requiring those contractors to provide me information, maybe from automated tools or vulnerability scanning tools and highlight and attach that document to that particular vendor," he said. "Another area where we have seen where people have leveraged technologies and capabilities is independent virtual assessments of a third party contractor to see how secure they are from a public-facing perspective. There are a lot of different things we have seen agencies do where they are starting to leverage technology and tools. It's an evolutionary thing, it's a crawl, walk and run process."
About Archer
Archer, an RSA company, is a leader in providing integrated risk management solutions that enable customers to improve strategic decision making and operational resiliency. As true pioneers in GRC software, Archer remains solely dedicated to helping customers understand risk holistically by engaging stakeholders, leveraging a modern platform that spans key domains of risk and supports analysis driven by both business and IT impacts. The Archer customer base represents one of the largest pure risk management communities globally, with over 1,500 deployments including over 100 government organizations and 90 of the Fortune 100.
Sign up for breaking news.
More about Dan Carayiannis
Executive Editor, Federal News Network
More about Jason Miller
Or manage your existing subscription
Install our app for news on the go
1|20 Atlassian and Microsoft 365 – How to...
1|20 Maintenance Repair Facility Supplies...
1|20 Accelerating Your Digital...
Fed Photo of the Day
Service members participate in the Pass in Review at the Capitol building during the 59th Presidential Inauguration rehearsal ceremony
About FNN
Partners & Events
WTOP
Follow Federal News Network on Facebook
Follow Federal News Network on Twitter
Follow Federal News Network on Linkedin
Follow Federal News Network on Instagram
Go Apple's Website to download the APP
Go Google's Website to download the APP
Copyright/Usage Policy
Copyright 2021 Hubbard Radio Washington DC, LLC. All rights reserved. This website is not intended for users located within the European Economic Area.
Dan Carayiannis currently serves as RSA Archer's Public Sector Director. With a career spanning over 30 years, Mr. Carayiannis has held several executive leadership positions with information technology, IT security, geospatial and services companies servicing government and commercial enterprise customers. Mr. Carayiannis has been with RSA Archer for 12 years and is responsible for Archer's Go-To-Market initiatives within the federal, state, local and international public sector marketplace. Mr. Carayiannis' responsibilities includes leading RSA Archer's public sector initiatives defining future Archer solution requirements for the public sector as well as supporting Archer's commercial market initiatives involving federal regulations and directives. Mr. Carayiannis holds a BBA from James Madison, an MBA from Marymount University and was awarded a Duke University Executive Development Program certificate. Mr. Carayiannis has spoken at a wide range of industry conference engagements on RSA Archer's behalf, is an active member of several industry related associations and has served on business and university advisory boards.
Jason Miller is an executive editor and reporter with Federal News Radio. As executive editor, Jason helps direct the news coverage of the station and works with reporters to ensure a broad range of coverage of federal technology, procurement, finance and human resource news. As a reporter, Jason focuses mainly on technology and procurement issues, including cybersecurity, e-government and acquisition policies and programs.