What it means
OT supply chain risk includes weaknesses, malicious functionality, counterfeit components, insecure development, remote services, support dependencies, and lifecycle failures in products and providers.
Why it matters
Long asset lifecycles and specialized vendors can create deep dependency on firmware, integrators, update channels, proprietary tools, and scarce replacement parts.
Practical focus
- Tier suppliers and products by process criticality, access, update authority, software and hardware provenance, support model, and replacement difficulty.
- Set acquisition requirements for secure development, vulnerability handling, component transparency, access, updates, incident notice, evidence, support, and end of life.
- Monitor advisories, ownership changes, support status, remote access, sub-suppliers, integrity, counterfeit risk, and exit readiness.
- Preserve this evidence: Retain supplier assessments, requirements, contracts, provenance, component and firmware records, access, advisories, exceptions, monitoring, and transition plans.
- Exercise this failure scenario: A critical controller or vendor service reaches end of support or ships a compromised update without a tested alternative, integrity check, or response plan.
Common mistakes
- Using the label OT Supply Chain Risk without defining scope, ownership, decision authority, and the exact data, systems, people, or process affected.
- Treating a policy, contract, diagram, dashboard, or tool demonstration as proof that OT Supply Chain Risk operates consistently in production.
- Closing work without retaining the evidence needed to reconstruct the decision and verify the intended control outcome.
- Testing only the normal path and never rehearsing the failure condition: A critical controller or vendor service reaches end of support or ships a compromised update without a tested alternative, integrity check, or response plan.
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: