<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE dita
  PUBLIC "-//OASIS//DTD DITA Composite//EN" "ditabase.dtd">
<dita xmlns:ditaarch="http://dita.oasis-open.org/architecture/2005/"
      domains="(topic task)                            (topic concept)                            (topic concept glossentry)                            (topic concept glossgroup)                            (topic reference)                            (topic troubleshooting++task) (topic task)                            (topic abbrev-d)                            a(props deliveryTarget)                            (topic equation-d)                            (topic hazard-d)                            (topic hi-d)                            (topic indexing-d)                            (topic markup-d)                            (topic mathml-d)                            (topic pr-d)                            (topic relmgmt-d)                            (topic sw-d)                            (topic svg-d)                            (topic ui-d)                            (topic ut-d)                            (topic markup-d xml-d)                            (topic task strictTaskbody-c)   "
      ditaarch:DITAArchVersion="1.3">
	  <concept id="GSAM_504_7002"
            ditaarch:DITAArchVersion="1.3"
            class="- topic/topic concept/concept ">
		    <title class="- topic/title ">
         <ph class="- topic/ph " props="autonumber">504.7002</ph> Policy.</title>
		    <conbody class="- topic/body  concept/conbody ">
			      <ol class="- topic/ol ">
				        <li id="yrTQzO" class="- topic/li ">
					          <p id="MakRRC" class="- topic/p ">
                  <ph props="autonumber" class="- topic/ph ">(a)</ph>The Federal Information Security Modernization Act of 2014 (Public Law 113-283) and associated National Institute of Standards and Technology (NIST) guidance requires Federal agencies to manage supply chain risks for Federal information systems and to ensure the effectiveness of information security controls and risks.</p>
				        </li>
				        <li id="CFBMPz" class="- topic/li ">
					          <p id="gpLlkQ" class="- topic/p ">
                  <ph props="autonumber" class="- topic/ph ">(b)</ph>The SECURE Technology Act (Public Law 115-390), which includes the Federal Acquisition Supply Chain Security Act of 2018, established the Federal Acquisition Security Council (FASC) to improve executive branch coordination, supply chain information sharing, and actions to address supply chain risks and requires GSA to have a lead representative for the agency.</p>
				        </li>
				        <li id="10tdtow3" class="- topic/li ">
					          <p id="qybvngp" class="- topic/p ">
                  <ph props="autonumber" class="- topic/ph ">(c)</ph> OMB Circular A-130, “Managing Information as a Strategic Resource,” directs agencies to implement supply chain risk management principles to protect against the insertion of counterfeits, unauthorized production, tampering, theft, insertion of malicious software, and poor manufacturing and development practices throughout the system development life cycle. </p>
				        </li>
				        <li id="l9ft7qob" class="- topic/li ">
					          <p id="fl5bywli" class="- topic/p ">
                  <ph props="autonumber" class="- topic/ph ">(d)</ph> GSA Information Technology (IT) Security Procedural Guide CIO-IT Security-01-02, “Incident Response (IR)” (including successor policies), provides additional processes and procedures for incident response, as outlined by GSA’s Office of the Chief Information Security Officer (OCISO). </p>
				        </li>
				        <li id="r2l0xs9" class="- topic/li ">
					          <p id="gbc2fvtn" class="- topic/p ">
                  <ph props="autonumber" class="- topic/ph ">(e)</ph> GSA Information Technology (IT) Security Procedural Guide CIO-IT Security-21-117, “Office of the Chief Information Security Officer (OCISO) Cyber Supply Chain Risk Management (C-SCRM) Program” (including successor policies), establishes a C-SCRM program within GSA’s OCISO and serves as the Tier 2 plan for GSA. </p>
				        </li>
				        <li id="vt2c9bg" class="- topic/li ">
					          <p id="s8ondkc" class="- topic/p ">
                  <ph props="autonumber" class="- topic/ph ">(f)</ph> GSA CIO Order 2100.1, “GSA Information Technology (IT) Security Policy” (including successor policies), sets forth GSA’s IT security policy and establishes controls required to comply with Federal laws and regulations. </p>
				        </li>
			      </ol>
		    </conbody>
	  </concept>
</dita>
