The Office of the Director of National Intelligence is not immune to the struggle that all corners of the federal government face on securing its supply chain.<\/p>\n\n\n\n
ODNI general counsel Jason Klitenic, speaking Feb. 5 at the American Bar Association, outlined several supply chain security questions that the office wants addressed, but is finding hard to answer.<\/p>\n\n\n\n
How much information can ODNI lawfully share? <\/b><\/p>\n\n\n\n
ODNI wants to be able to share actionable threat intelligence with unwitting companies that are making acquisition decisions. The central challenge for the office in this situation is protecting sources and methods, the perennial issue in the intelligence community\u2019s information sharing relationships.<\/p>\n\n\n\n
\u201cIf we pick up intel or information that there\u2019s a product out there that may have a vulnerable but we\u2019re aware of it, but the company may not be aware of it, how can we possibly make sure that the company … is aware of it?\u201d Klitenic said.<\/p>\n\n\n\n
To solve this problem, ODNI is trying to work out how to get information declassified or how to do a one-time read-in for specific members of the company.<\/p>\n\n\n\n
To what extent can federal agencies influence the conduct of our suppliers?<\/b><\/p>\n\n\n\n
Klitenic said that the ODNI wants to know if they can influence security compliance through security requirements embedded within contracts.<\/p>\n\n\n\n
\u201cHow far can we go in terms of including contractual terms that impose security obligations and enforcing compliance with those obligations?\u201d Klitenic asked.<\/p>\n\n\n\n
ODNI might want to look for guidance at the Department of Defense, which recently tightened its cybersecurity requirements for its contracts in a move that\u2019s likely to have widespread implications for prime and subprime contractors. Those new standards will be put in contracts later this year.<\/p>\n\n\n\n
Klitenic mentioned two other questions facing ODNI, though he didn\u2019t elaborate on them:<\/p>\n\n\n\n
What actions on supply chain risk management can the government take on both federal and non-federal IT systems?<\/b><\/p>\n\n\n\n
Is there an obligation for the IC to engage with industry to propose mitigation measures? <\/b><\/p>\n","protected":false},"excerpt":{"rendered":"
Here’s what the Office of the Director of National Intelligence general counsel said the IC is wrestling with.<\/p>\n","protected":false},"author":7,"featured_media":27541,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":10,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[10,106,29,16,32],"tags":[],"coauthors":[3252],"class_list":["post-19745","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber","category-daily-brief","category-home","category-it-networks","category-newsletters"],"acf":{"subheadline":"","legacy_arc_id":"CWFYKON7AVHMNLM6VLPHZK37QI","arc_canonical_url":"\/civilian\/2020\/02\/05\/the-intelligence-communitys-questions-on-supply-chain-security\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n