When attackers want to compromise corporate networks, they find weak links in the chain. Cybercriminals aren’t in the business of going head to head with network security solutions — they prefer undetected, unprotected entry points.

As noted by SecurityWeek, this often leads to supply chain attacks. Even companies with solid security policies are at risk of data breaches if third-party suppliers don’t safeguard their own assets. A recent cybersecurity risk assessment revealed a significant disconnect between federal agencies and approved government contractors, putting the entire supply chain under threat.

Cybersecurity Risk Assessment Reveals Supply Chain Security Gaps

While federal agencies are under increasing pressure to meet security best practices, such as National Institute of Standards and Technology (NIST) security guidance and standards, supply chain organizations further down the pipeline may escape direct observation, making it easy to avoid costly IT changes.

A recent BitSight survey compared the security performance of 120 agencies to 1,200 contractors. It found a performance gap of at least 15 points on a cybersecurity risk assessment scale of 250–900, with higher scores equating to stronger security posture.

Of greater concern were specific issues common to supply chain contractors, which were rated on an A–F scale. For example, 20 percent of those surveyed said they still use outdated internet browsers, putting them at risk of new malware vectors. In addition, almost 50 percent of contractors received a C grade for their use of protective technologies in line with the NIST cybersecurity framework.

Put simply, federal agencies are doubling down on cybersecurity, but supply chain contractors aren’t keeping pace.

Sniffing Out Supply Chain Threats

The first step toward improving supply chain security is recognizing the problem. As noted by FCW, that’s the idea behind a new internal supply chain cybersecurity initiative launched by the U.S. Department of Homeland Security (DHS). The program aims to dig down and discover exactly where supply chain threats are coming from. Using a “focused effort with dedicated staff,” the agency is partnering with NIST to unpack critical risks and develop mechanisms to improve overall security.

This may be easier said than done. As Federal News Radio pointed out, while NIST guidelines offer a solid starting point, the next step for supply chain security is creating frameworks that provide “consistent ways to measure the effectiveness of security controls.”

It’s not enough to simply spend more on security and check off cybersecurity risk assessment boxes. Contractors and federal agencies must be able to actively and reliably monitor supply chain security controls to see what’s working, what isn’t and where new security solutions offer the biggest benefit.

Federal supply chains are at risk, with contractors lagging behind agencies when it comes to NIST adoption and threat awareness. Improving overall security means recognizing the shortfall and implementing effective controls that both meet minimum standards and provide active, accurate feedback about security efficacy.