Key Takeaways
- The White House Office of the Federal Chief Information Officer (CIO) is reviewing how agencies report and manage cyber supply chain security programs to obtain a clearer, government‑wide view of shared risks, especially those linked to foreign adversaries.
- The review is anchored in the National Institute for Standards and Technology (NIST) “Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations” guidelines.
- Cheri Benedict, senior cyber supply chain advisor in the federal CIO’s office, said the initiative will update compliance mechanisms that have not been revised since the SECURE Technology Act of 2018.
- Emphasis is placed on identifying and mitigating adversarial risks through shared‑risk metrics and improved data collection.
- The Federal Acquisition Security Council (FASC) continues to issue vendor exclusion orders, most recently against Switzerland‑based Acronis AG.
- Bipartisan legislation in the House Select Committee on China seeks to move FASC into the Executive Office of the President and give it dedicated staff to monitor high‑risk foreign technology.
- The administration’s 2026 National Cybersecurity Strategy advocates a “left of boom” approach—screening vendors before contract award—to keep risky products out of federal systems.
- Operational challenges include lengthy acquisition timelines, but officials argue deeper pre‑award scrutiny is justified for high‑priority assets.
- Successful implementation will require agencies to update internal processes, training, and documentation while fostering cross‑agency collaboration on threat intelligence.
- A modernized FASC combined with left‑of‑boom screening aims to reduce the success of foreign adversary attempts to compromise federal supply chains.
Overview of the Current Review Initiative
The White House Office of the Federal Chief Information Officer (CIO) has launched a comprehensive review of how federal agencies report and manage their cyber supply chain security programs. This effort is driven by the need to obtain a clearer, government‑wide picture of shared risks, particularly those stemming from foreign adversaries that may seek to compromise critical systems through tainted hardware or software. By re‑examining existing data‑collection mechanisms, the CIO’s office hopes to produce updated metrics that can be deployed in the near term. The review will inform future policy decisions, guide resource allocation, and strengthen the nation’s ability to defend against supply‑chain threats that cross agency boundaries.
NIST Cybersecurity Supply Chain Risk Management Guidelines
At the heart of the review are the National Institute for Standards and Technology (NIST) guidelines titled “Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.” These standards provide a framework for evaluating risks associated with products and services that may contain malicious functionality, be counterfeit, or suffer from vulnerabilities due to poor manufacturing and development practices. Agencies are expected to align their internal processes with these guidelines to ensure a consistent baseline of security across the federal enterprise. The CIO’s office is assessing how well agencies currently adhere to the NIST framework and where gaps remain that require updated compliance mechanisms.
Role of the Federal CIO Office and Cheri Benedict’s Comments
Cheri Benedict, senior cyber supply chain advisor within the federal CIO’s office, outlined the objectives of the review during a recent webinar hosted by the Intelligence and National Security Alliance. She emphasized that the initiative is not merely a bureaucratic exercise but a strategic effort to capture the maturity of agency programs and to foster collaboration across the government. Benedict noted that the review will examine all existing practices and procedures related to NIST‑based supply chain risk management, with the goal of informing a revised data‑collection approach that better reflects shared risk perspectives, especially those tied to foreign adversaries.
Background of the SECURE Technology Act and the Federal Acquisition Security Council
The foundation for today’s review lies in the Strengthening and Enhancing Cyber‑capabilities by Utilizing Risk Exposure (SECURE) Technology Act of 2018. That legislation created the Federal Acquisition Security Council (FASC), an interagency body tasked with identifying supply chain risk management standards and guidelines, and with recommending actions to exclude or remove high‑risk vendors from federal supply chains. The SECURE Act also mandated periodic updates to the associated compliance frameworks. Because the last major update followed the act’s passage, the CIO’s office now views the current review as a necessary refresh to keep pace with evolving threats.
Recent Exclusion Order Against Acronis AG
In September 2025, nearly seven years after the SECURE Act became law, the Director of National Intelligence adopted a FASC recommendation to issue the first‑ever removal and exclusion order against Acronis AG, a Switzerland‑based technology firm. The order prohibits the use of Acronis products in intelligence community procurements and in systems handling sensitive compartmented information. This action illustrates how the FASC can translate risk assessments into concrete procurement restrictions, serving as a proof‑of‑concept for the broader government‑wide supply chain security regime that the CIO’s office is now seeking to modernize.
Congressional Efforts to Modernize the FASC
House lawmakers serving on the Select Committee on China have introduced bipartisan legislation aimed at strengthening the FASC. The proposed bill would relocate the council into the Executive Office of the President, providing it with a more prominent institutional home and dedicated staff tasked with continuously monitoring high‑risk foreign vendors and equipment across the federal government. By elevating the FASC’s status and resources, legislators hope to accelerate the identification and mitigation of supply chain threats, ensuring that the council can keep pace with the rapid evolution of adversarial tactics.
Alignment with the 2026 National Cybersecurity Strategy
The review also aligns with the Trump administration’s 2026 National Cybersecurity Strategy, which explicitly calls for moving “away from adversary vendors and products” while promoting the adoption of homegrown U.S. technologies. Cheri Benedict highlighted that officials want to shift to a “left of boom” posture in supply chain security—identifying and excluding risky vendors and products before they are ever awarded a federal contract. This proactive stance is intended to reduce the likelihood that compromised components ever enter government systems, thereby enhancing overall resilience.
Operational Challenges and the “Left of Boom” Objective
Achieving a left‑of‑boom approach presents practical difficulties, notably the already prolonged acquisition timelines that characterize many federal procurements. Benedict acknowledged that conducting thorough supply chain reviews prior to contract award adds complexity and may extend timelines further. Nevertheless, she argued that for high‑priority assets—such as weapons systems, critical infrastructure platforms, and classified networks—the investment in deeper pre‑award scrutiny is justified. The goal is to develop tools and processes that allow agencies to see more deeply into their supply chain landscapes, especially as artificial intelligence introduces new vectors for hidden risk.
Implications for Federal Agencies and Future Outlook
For federal agencies, the forthcoming revamp of data collection and reporting will likely require updates to internal risk management procedures, staff training, and documentation practices. Agencies that already maintain mature cyber supply chain programs may find the transition smoother, while others may need to invest in building capacity to meet the new expectations. The emphasis on shared risk metrics encourages cross‑agency collaboration, potentially leading to joint threat intelligence feeds and coordinated mitigation actions. In the longer term, a modernized FASC coupled with left‑of‑boom screening could significantly reduce the success rate of foreign adversary attempts to infiltrate federal systems through compromised hardware or software.
Conclusion
The White House Office of the Federal CIO’s review of governmentwide cyber supply chain security standards represents a pivotal step toward fortifying the federal procurement ecosystem against evolving threats. By grounding the effort in NIST guidance, leveraging the legislative framework of the SECURE Technology Act, and responding to recent actions such as the Acronis AG exclusion, the initiative seeks to create a more transparent, collaborative, and proactive supply chain security posture. As Congress considers enhancements to the FASC and the administration pursues a left‑of‑boom strategy outlined in the 2026 National Cybersecurity Strategy, federal agencies can anticipate clearer metrics, stronger oversight, and a heightened focus on keeping adversarial risks out of the nation’s critical technology supply chains.