Regulations are forcing organizations to address software supply chain security
Summary
In the operational technology (OT) world this often means vendors having access to maintain and support systems such as power generation plants, water treatment, and automated manufacturing equipment. Some new directives and standards are moving to more enforcement of certifications and shared responsibility for supply chain security to address the slow implementation of current cybersecurity practices. NIS2, on the other hand, focuses on the end user or enterprise entity ensuring proper risk management techniques are enforced in the deployment of cyber technologies. Ensuring failure to implement proper procedures has fines and responsibilities attached that will assist in making sure the C-SCRM occupies a key place in an organization’s management strategy. These regulations provide a good example of the need to address both sides of the cybersecurity software supply chain and apply financial and/or reporting requirements for enforcement.