An Integrated Approach to Cyber Supply Chain Risk Management

Globally, significant efforts are underway to develop methods and best practices for securing the supply chain and enabling detection of supply chain attacks in critical infrastructure. In conjunction with these efforts, it is imperative to ensure that stakeholders in the nuclear sector understand these cyber supply chain risk management (CSCRM) best practices so they can deploy relevant strategies in their organizations to reduce threats from their supply chain. The U.S. Department of Energy (DOE) National Nuclear Security Administration’s Office of International Nuclear Security and the U.S. DOE Office of Cybersecurity, Energy Security, and Emergency Response is addressing this problem by developing and disseminating targeted CSCRM outreach and workshop materials for vendors, operators, and regulators. Methodologically, the project involved one-on-one engagements with nuclear reactor vendors to assess their current CSCRM posture, followed by the creation of standalone modules and a comprehensive 3-day workshop. Initial findings from vendor engagements informed development of tailored materials. The goal is to use a proactive approach to CSCRM, supported by targeted education, to improve organizational CSCRM awareness and practices and significantly reduce global nuclear cybersecurity risks.