Contrasting global approaches for identifying and managing cybersecurity risks in supply chains

TL;DR

This paper compares international approaches to identifying and managing cybersecurity risks in supply chains, highlighting the need for standardized guidance and discussing NIST SP 800-161 as a potential framework.

Contribution

It provides a comparative analysis of global cybersecurity risk management strategies in supply chains and discusses the alignment of NIST standards with these approaches.

Findings

Diverse levels of detail in national guidance

Guidance is often disjointed across countries

NIST SP 800-161 aligns with the taxonomy and offers a pathway to standardization

Abstract

Supply chains are increasingly targeted by threat actors. Using a recent taxonomy, we contrast the diverse levels of detail given by national authorities. The threat is commonly acknowledged, but guidance is disjointed. NIST SP 800-161 aligns closely with the taxonomy and offers a potential pathway towards a common set of principles.