This two-day course consists not only of training in understanding Cybersecurity Supply Chain Risk Management (C-SCRM), but also provides guidance in preparing organizations to deal with the myriad of risks that come from the supply chain. It covers the basics of C-SCRM and then dives deeply into NIST C-SCRM guidance, integration into enterprise risk management, success factors, controls, and implementing effective C-SCRM through the lens of several realistic scenarios. Also included is a primer, linked to free templates, on creating your own C-SCRM program.
The Cybersecurity Supply Chain Risk Management (C-SCRM) course is appropriate for anyone who deals with risk, security, or technology related to the supply chain in an organization. This includes business, security, and IT professionals or anyone else who is a stakeholder in Cybersecurity Supply Chain Risk Management (C-SCRM). This course is specifically for those who have responsibility for or interest in C-SCRM. This is not a general IT security course.
Student Testimonials
Instructor did a great job, from experience this subject can be a bit dry to teach but he was able to keep it very engaging and made it much easier to focus.
Student
Excellent presentation skills, subject matter knowledge, and command of the environment.
Student
Instructor was outstanding. Knowledgeable, presented well, and class timing was perfect.
Student
Click here to print this page »
Prerequisites
Basic computer knowledge and an interest in creating or improving Cybersecurity Supply Chain Risk Management (C-SCRM) in an organization.
Detailed Class Syllabus
Module 1: Course Introduction
Provides the student with information relative to the course and the conduct of the course in the classroom, virtual classroom, and course materials.
Module 2: The Basics of Cybersecurity Supply Chain Risk Management
What is C-SCRM
ICT, IT, OT, and Enterprise vs Organization
The Dimensions of SCRM
Describing the Supply Chain of an Enterprise
Internal C-SCRM Stakeholders
Module 3: An Overview of NIST SP 800-161r1
Name and Purpose
Relationship to other NIST Publications
o Cybersecurity Framework (NIST CSF)
o Describing the NIST 800 Special Publication Series
o SP 800-37, Revision 2: The NIST Risk Management Framework (RMF)
o SP 800-39, Managing Information Security Risk: Organization, Mission, and
o Information System View
o SP 800-53, Revision 5: Security and Privacy Controls for Information Systems and Organizations
o SP 800-53B Control Baselines for Information Systems and Organizations
o SP 800-181, Revision 1, National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework
Design of the Publication
Module 4: Integration of C- SCRM into Enterprise Risk Management
The Enterprise Risk Management Process
The Business Case for C-SCRM
Cybersecurity Risks Throughout Supply Chains
Multilevel Risk Management
o Defining Roles and Responsibilities
o Level 1 – Enterprise
o Level 2 – Mission and Business Process
o Level 3 – Operational
C-SCRM Program Management Office (PMO)
Module 5: Critical Success Factors in C-SCRM
C-SCRM in Acquisition
Supply Chain Information Sharing
C-SCRM Training and Awareness
C-SCRM Key Practices
Capability Implementation Measurement and C-SCRM Measures
Dedicated Resources
Module 6: C-SCRM Security Controls
Introduction and Background
Controls Design
C-SCRM Controls Throughout the Enterprise
o Applying C-SCRM Controls to Acquiring
o Considerations for Suppliers
o Considerations for Developers and Manufacturers
o Considerations for System Integrators
o Considerations for External System Service Providers of Information System Services
o Considerations for Other ICT/OT-Related Service Providers
Selecting, Tailoring, And Implementing C-SCRM Security Controls
C-SCRM Control Family Summaries
Module 7: The Risk Exposure Framework
Threat Scenario Description and Use Cases
Risk Exposure Framework
o Step 1: Create a Plan for Developing and Analyzing Threat Scenarios
o Step 2: Characterize the Environment
o Step 3: Develop and Select Threat Events for Analysis
o Step 4: Conduct an Analysis Using the Risk Exposure Framework
o Step 5: Determine C-SCRM Applicable Controls
o Step 6: Evaluate/Feedback
Risk Exposure Framework Example
Risk Exposure Framework Scenarios
o Scenario 1: Influence or Control by Foreign Governments Over Suppliers
o Scenario 2: Telecommunications Counterfeits
o Scenario 3: Industrial Espionage
o Scenario 4: Malicious Code Insertion
o Scenario 5: Unintentional Compromise
o Scenario 6: Vulnerable Reused Components Within Systems
Module 8: A Primer on Creating a C-SCRM Program
C-SCRM Strategy and Implementation Plan
C-SCRM Policy
C-SCRM Plan
Cybersecurity Supply Chain Risk Assessment Template