CAP Supply Chain Risk Management

Question 1

What is Information and Communications Technology Supply Chain Risk Management (ICT SCRM)?

Accepted Answer

The process of identifying, assessing, and mitigating risks associated with the global supply chain for IT products and services

Answer

Managing vendor contracts for software licenses only

Answer

Auditing the source code of all purchased applications

Answer

Verifying that all hardware is manufactured domestically

Question 2

Which NIST publication provides guidance specifically on supply chain risk management for federal systems?

Accepted Answer

NIST SP 800-161

Answer

NIST SP 800-53

Answer

NIST SP 800-171

Answer

NIST SP 800-37

Question 3

Which NIST SP 800-53 control family specifically addresses supply chain risk management?

Accepted Answer

SR (Supply Chain Risk Management)

Answer

SA (System and Services Acquisition)

Answer

CA (Assessment, Authorization, and Monitoring)

Answer

PM (Program Management)

Question 4

What is a 'counterfeit component' threat in the context of ICT supply chain risk?

Accepted Answer

Hardware or software that is fraudulently represented as genuine but may contain malicious functionality or quality defects

Answer

A software license purchased from an unauthorized reseller

Answer

A configuration setting that deviates from vendor defaults

Answer

An outdated firmware version that has known vulnerabilities

Question 5

What is a Software Bill of Materials (SBOM) and why is it important for supply chain security?

Accepted Answer

A formal record of software components and their dependencies, enabling organizations to identify vulnerable libraries quickly

Answer

A vendor contract listing all software covered under a license agreement

Answer

A government-mandated list of approved software vendors

Answer

A log of all software changes made during system development

Question 6

Which executive order significantly elevated the importance of software supply chain security for federal agencies?

Accepted Answer

Executive Order 14028 (Improving the Nation's Cybersecurity)

Answer

Executive Order 13636 (Improving Critical Infrastructure Cybersecurity)

Answer

Executive Order 13800 (Strengthening Federal Networks)

Answer

Executive Order 12333 (United States Intelligence Activities)