Hardware Supply Chain Risk Assessment from CISA

The U.S. CISA has released a new framework designed to improve the accuracy of risk assessments in the hardware supply chain.

The new Hardware Bill of Materials Framework for Supply Chain Risk Management, is a product of the Information and Communications Technology Supply Chain Risk Management Task Force that has been designed to offer a consistent and repeatable way for vendors and purchasers to communicate about hardware components. The HBOM enables effective risk assessment and mitigation in the supply chain.

The HBOM provides a framework that recommends using a consistent naming methodology for the attributes of components, a format for identifying and providing information about the different types of components and guidance of what HBOM information is appropriate depending on the purpose for which the HBOM will be used.

The framework has several components.

• The first component — use case category — providers potential use cases that purchasers may have for HBOMs, based on the nature of the risk the purchaser seeks to evaluate.
• The second component offers a format that can be used to ensure consistency across HBOMs and to increase the ease with which HBOMs can be produced and used.
• The third component — Data Field Taxonomy — provides a taxonomy of component and input attributes that may be appropriate to include in an HBOM.

This gives organizations a useful tool to evaluate supply chain risks with a consistent and predictable structure for a variety of use cases.

The framework also succeeds in emphasizing the necessity of transparency within the supply chain to keep consumers safe. The risk level of a specific vulnerability within a product will be different for every buyer depending on implementation. It is imperative that buyers have as much information and context as possible so they can make calculated decisions to prioritize vulnerability handling and anticipate where they might emerge.