Important RFI, and I note the US banking regulators have paid increasing attention to C-SCRM among their regulated populations.
www.federalregister.gov/documents/20...

Apart from his overall thesis about focusing on operationally disruptive hacks > data breaches, I appreciate his criticism of how national C-SCRM policy has, essentially, been limited to ‘Ban China’ and ignored the cobwebs in _Western_ vendors’ gear.

I can finally start collecting data for my study exploring the impact of frameworks and policies on internal Cyber supply chain risk management (C-SCRM). If you'd like to participate, click the link provided.
ncu.co1.qualtrics.com/jfe/form/SV_...

#PhdStudy #CSCRM #riskmanagement #Cybersecurity

'Machine tools maker DMG Mori sends IT personnel along with procurement staff on visits to supplier factories'.

Good companies have great C-SCRM/vendor due diligence teams. The question is: are those teams well-resourced and respected _at Board level_?
archive.md/JCzOi

Our key takeaways:
➡️ High cybersecurity awareness alone does not significantly improve performance.
➡️ When awareness translates into C-SCRM practices, financial performance improves
➡️ C-SCRM is the key link between awareness and better results, especially in financial terms.

Cyber threats are one of the top global business risks and
SMEs are especially exposed. So what helps SMEs most?

We explore how cybersecurity awareness and cybersecurity supply chain risk management (C-SCRM) impact financial and commercial performance in small and medium-sized manufacturers.

What links cybersecurity awareness and supply chain risk management, and why does it matter for small manufacturers?

We explore how these factors shape firm performance in our latest paper doi.org/10.1108/SCM-... in the journal Supply Chain Management.

#Cybersecurity #SupplyChain #C-SCRM #SMEs

La semana que viene estaremos en las oficinas de SCRM con mi compañero Joan López de la Franca compartiendo con la comunidad de Grafana & Friends las últimas novedades de las versiones k6 1.0 y Grafana 12 🎉

🗓️ 4 de junio 2025, 18:30
📍c/ Bergara 13, Barcelona

📎 RSVP www.meetup.com/grafana-and-...

Cybersecurity supply chain risk management (C-SCRM) assessments start with due diligence. csrc.nist.gov/pubs/sp/1326...

NIST Releases the C-SCRM Due Diligence Assessment Quick-Start Guide for Public Comment https://buff.ly/4fmlO2W

CISA publishes Software Acquisition Guide to add software assurance in C-SCRM lifecycle

C-SCRM in CNI matters, folks.

Orgs like Energy One are juicy targets for intelligence services wanting to drop logic bombs in the OT run by their customers.
www.csoonline.com/article/6499...

Most of the report could be summarised like so:
- Have good MFA (already knew that)
- Telcos need to lift their game (ditto)
- Do good C-SCRM (ditto)
- Focus on resilience (ditto)
- Rehearse IR (ditto)
- Manage (non-)malicious insider risk (ditto)
- Talk to the feds (ditto)

C-SCRM/Software SCRM is clearly on the minds of many many CISOs, per this survey (n = 208) by Censys.
Full survey: https://censys.io/the-2023-state-of-security-leadership/

Mr Pescatore in the latest edition of SANS NewsBites on the Microsoft cloud:

'... a good reminder that using cloud services does not eliminate the need to monitor them continually for abnormal activity'.

Folks, using a cloud service behoves you to do robust C-SCRM.

If you don't, you're mugs.

'According to JP Morgan, it only became aware of this in October of 2019 when the company’s legal discovery team found that electronic communications were missing from the early 2018 time period. It reported the incident to the SEC in January 2020'.

C-SCRM matters in CNI, people

The stupidity of superficial labeling on full display re. #crm (#scrm) vs #socialmedia. C: http://bit.ly/aeLTaa . #linkeddata will fix!