Supply Chain Security & Vendor Management Flashcards

Which of the following BEST describes the primary goal of supply chain security in an industrial environment?

Answer: Ensuring integrity, authenticity, and continuity of goods and services throughout the supply chain

Supply chain security aims to protect the integrity, authenticity, and continuity of products and services from origin through delivery to the end user.

A company discovers that a critical component supplier has been acquired by a foreign entity with potential ties to a nation-state adversary. What is the MOST appropriate immediate action?

Answer: Conduct a supply chain risk assessment and consider alternative suppliers

A supply chain risk assessment allows the organization to evaluate the actual threat level and develop an informed mitigation strategy, including identifying alternative suppliers if necessary.

Which federal regulation requires contractors handling classified information to implement supply chain risk management (SCRM) practices?

Answer: NISPOM (32 CFR Part 117)

The National Industrial Security Program Operating Manual (NISPOM), codified at 32 CFR Part 117, governs cleared contractors and includes supply chain risk management requirements.

What is a 'counterfeit part' in the context of supply chain security?

Answer: An item that is a copy, imitation, or substitute that has been misrepresented as genuine

A counterfeit part is misrepresented as genuine or authorized, posing safety and security risks especially in critical industrial systems.

Which of the following is an example of a SECOND-TIER supply chain risk?

Answer: A subcontractor used by your primary vendor experiencing a data breach

Second-tier (or sub-tier) risks involve suppliers of your suppliers; a subcontractor breach can propagate vulnerabilities up through your primary vendor to your organization.

Which practice is MOST effective in verifying the authenticity of hardware components received from a supplier?

Answer: Testing against known-good baselines and reviewing traceability documentation

Testing against known-good baselines and verifying traceability documentation (including provenance records) are the most effective methods for detecting counterfeit or tampered components.

What does the term 'vendor lock-in' represent as a supply chain security concern?

Answer: Excessive dependence on a single vendor that limits an organization's ability to switch suppliers

Vendor lock-in creates a single point of failure and reduces negotiating leverage, making the organization vulnerable if that vendor is compromised, disrupted, or becomes adversarial.