Vendor and Supply-Chain Risk for Defense Contractors

A defense contractor's security is only as strong as the suppliers it shares information and access with. Subcontractors receive drawings and specifications. Managed service providers hold administrator credentials. Software vendors push updates into your environment. Attackers know this, and compromising a smaller supplier is often easier than attacking a prime directly.

For organizations supporting the Department of War, supply-chain security is also a contractual obligation.

How requirements flow down

DFARS 252.204-7012 requires contractors to safeguard covered defense information using NIST SP 800-171, report cyber incidents to the Department, and flow the clause down to subcontractors whose work involves covered defense information. Subcontractors in turn have their own reporting obligations, including notifying the prime.

CMMC requirements also flow down. Subcontractors that process, store or transmit federal contract information or controlled unclassified information need the CMMC level appropriate to the information they handle, which may differ from the prime's level.

In practice, primes need to know which suppliers will receive CUI or FCI, confirm those suppliers have the required status before sharing it, and avoid sending controlled information to suppliers who do not need it.

Assessing suppliers

Not every supplier needs the same scrutiny. Tier them by the information and access they have:

• High risk: suppliers that handle CUI, have network or administrative access, or provide software that runs inside your environment.
• Moderate risk: suppliers that handle FCI or business-sensitive data, or connect to limited systems.
• Low risk: suppliers with no access to sensitive information or systems.

For higher tiers, go beyond a questionnaire. Ask for their CMMC status and Supplier Performance Risk System score where applicable, their system security plan or a summary of it, their incident response arrangements and evidence of key controls such as MFA. Questionnaires are useful for structure, but answers should be verified where the risk justifies it.

MSPs and external service providers

Managed service providers and managed security providers deserve particular attention. An MSP with remote management tools and privileged accounts across many customers is an attractive target, because compromising one provider can open many networks. CISA and partner agencies have published guidance on this risk.

• Understand their access. Which accounts, tools and systems do they use, and are those accounts protected with phishing-resistant MFA?
• Limit and log it. Give providers only the access they need, and keep their activity visible to your own monitoring.
• Check the scope impact. Under CMMC, external service providers that handle CUI or security data can fall within your assessment scope.
• Cloud services matter too. Cloud services that store or process covered defense information must meet the FedRAMP Moderate baseline or equivalent under DFARS 252.204-7012.

Contract clauses that help

• Required security standards and certification levels, with an obligation to maintain them.
• Incident notification timelines and cooperation with investigations.
• The right to request evidence of controls or to assess the supplier.
• Limits on further subcontracting of work involving controlled information without approval.
• Return or destruction of information when the work ends.
• Requirements for secure software development and vulnerability disclosure for software suppliers.

Ongoing monitoring

A supplier that was secure at onboarding may not be secure two years later. Ownership changes, staff turn over, and new vulnerabilities appear in their products. Reassess high-risk suppliers on a schedule and when something changes, track their certification status, review the access they hold, and watch for public reports of breaches or exploited vulnerabilities in products they supply. NIST SP 800-161 provides a broader framework for cybersecurity supply-chain risk management.

When a supplier is compromised

Plan for it. Know which suppliers hold your data and access, who to call, and how to revoke their connections quickly. Include a supplier compromise scenario in your tabletop exercises, and make sure your own reporting obligations to the government are understood before you need them. Our incident response team can help both primes and suppliers when it happens.

How CDT can help

CDT works with the defense industrial base on supply-chain security. Our CMMC team helps primes structure flow-down and supplier assessments and helps smaller suppliers prepare for their own requirements.