You Outsource the Service but Not the Risk: Supply Chain Risk Management for the Cyber Security of Safety Critical Systems

摘要

Companies increasingly form interdependent relationships between contractors and sub-contractors that extendudacross national borders and legal jurisdictions. In consequence, supply chain risk management (SCRM) is anudincreasing concern for the cyber security of safety-critical systems. The following pages argue that outsourcingudundermines SCRM by eroding technical expertise, which companies need to select and audit their suppliers. Theyudare still held accountable when the failure of a sub-contractor jeopardizes the continuity of critical nationaludinfrastructures. Subsequent sections present SCRM techniques that support the cyber-security of safety-criticaludapplications and at the same time help to realize the benefits of vertical market integration. Rather than de-risking,udthe aim of the paper is to reiterate that ‘safety-critical organizations outsource the service but they do not outsourceudthe risk’.