<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE dita
  PUBLIC "-//OASIS//DTD DITA Composite//EN" "ditabase.dtd">
<dita xmlns:ditaarch="http://dita.oasis-open.org/architecture/2005/"
      ditaarch:DITAArchVersion="1.2"
      domains="(topic task)                            (topic concept)                            (topic concept glossentry)                            (topic concept glossgroup)                            (topic reference)                            (topic troubleshooting++task) (topic task)                            (topic abbrev-d)                            a(props deliveryTarget)                            (topic equation-d)                            (topic hazard-d)                            (topic hi-d)                            (topic indexing-d)                            (topic markup-d)                            (topic mathml-d)                            (topic pr-d)                            (topic relmgmt-d)                            (topic sw-d)                            (topic svg-d)                            (topic ui-d)                            (topic ut-d)                            (topic markup-d xml-d)                            (topic task strictTaskbody-c)   ">
   <concept id="i504-7002"
            audience="GSAM"
            ditaarch:DITAArchVersion="1.2"
            class="- topic/topic concept/concept ">
      <title class="- topic/title ">
         <ph props="autonumber" class="- topic/ph ">504.7002</ph> Policy.</title>
      <conbody class="- topic/body  concept/conbody ">
         <ol class="- topic/ol ">
            <li class="- topic/li ">
               <p class="- topic/p ">
                  <ph props="autonumber" class="- topic/ph ">(a)</ph>
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  The Federal
Information Security Modernization Act of 2014 and associated National
Institute of Standards and Technology (NIST) guidance requires Federal
agencies to manage supply chain risks for Federal information systems.</p>
            </li>
            <li class="- topic/li ">
               <p class="- topic/p ">
                  <ph props="autonumber" class="- topic/ph ">(b)</ph>
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  OMB Circular A-130, “Managing
Information as a Strategic Resource,” directs agencies to implement
supply chain risk management principles to protect against the insertion
of counterfeits, unauthorized production, tampering, theft, insertion of
malicious software, as well as poor manufacturing and development
practices throughout the system development life cycle.</p>
            </li>
            <li class="- topic/li ">
               <p class="- topic/p ">
                  <ph props="autonumber" class="- topic/ph ">(c)</ph>
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  
                  The SECURE Technology Act
(Public Law 115-390) requires GSA to have a lead representative
of the agency on the Federal Acquisition Security Council as well
as address supply chain risks posed by the acquisition of covered
articles.</p>
            </li>
         </ol>
      </conbody>
   </concept>
</dita>
