Build trusted, resilient supply chains and demonstrate the integrity of hardware and software products.
The Supply Chain Product Assurance Playbook is a proven and scalable process through which companies can assure hardware and software products and supply chains, build trust with customers, combat growing FOCI exposure, and proactively comply with emerging regulations related to product and supply chain security.
The Supply Chain Product Assurance Playbook enables risk identification, assessment, and remediation through enhanced sub-tier visibility, part and component level insights, and comprehensive supplier risk reporting and monitoring, equipping companies with the tools ensure and demonstrate product integrity, while facilitating rapid mitigation of identified risks.
Product Transparency
Exiger receives SBOM, HBOM, and software binaries for target product(s). Companies provide an attestation specifying the accuracy and composition of the provided artifacts.In the event that accurate SBOMs or HBOMs are not available, Exiger can generate SBOMs using binary files and can also ingest technical data packages (TDPs) and engineering drawings to develop HBOMs.
Sub-tier Supply Chain Illumination
Map the entire sub-tier supply chain from the finished product to the raw material inputs.
Exiger analyzes your HBOMs, TDPs, SBOMs, and binaries and leverages Natural Language Processing (NLP) and machine learning to parse more than 7 billion international bills of lading, customs records, and cyber relationships to map hardware and software product supply chains through multiple tiers of suppliers.
Supplier Risk Assessments
Identify, assess, and visualize holistic risk profiles for every supplier in 1Exiger’s interactive platform.
The 1Exiger platform queries over 31 million structured and unstructured data sets to generate, classify, and prioritize risk profiles for suppliers identified in Step 2. Each supplier receives a numerical score based on 4 categories of risk: foreign ownership, control, or influence (FOCI); reputational, criminal, and regulatory; financial; and operational.
Component and Part-Level Risk Reporting
Detail risks associated with specific parts and components.
Exiger analyzes hardware parts for counterfeit, single-source, end-of-life, and integrity risk. Software components are analyzed for bus factor, integration, and end-of-life risks, and any packages with CVEs or Known Exploited Vulnerabilities (KEVs) are flagged. Beyond leading indicator risk, Exiger conducts FOCI analysis on software components, tracing provenance to highlight potential obfuscation and identifying committers affiliated with high-risk jurisdictions or entities.
Mitigation Design and Implementation
Implement targeted mitigation strategies to strengthen your supply chain resilience.
Leveraging decades of cybersecurity and regulatory risk experience, experts from The Chertoff Group work with product owners to prioritize identified risks for targeted mitigation and then support the development and implementation of mitigation plans.
Communication and Collaboration
Build Trust and Assure Stakeholders with Transparent Risk Mitigation Updates.
Once mitigations are committed to or in place, the product owner, with support from The Chertoff Group, will socialize the action plan with decision-makers as a trust-building measure to communicate product assurance and alleviate customer concerns. Vulnerability Disclosure Reports for software help streamline outreach to customers. In some cases, communications may extend beyond the product to concerns about risks inherent to the product owner at the entity level.
Financial risk is a top risk factor for companies in the global marketplace. Not only is financial duress a key leading indicator for governance, cyber and operational risks, but the financial collapse of a critical vendor can shatter supply chains. Insolvency, bankruptcy or financial hardships that cripple crucial nodes in the network of modern business dependencies can create cascading failures throughout a system, as the world witnessed during the COVID-19 pandemic. In fact, 42% of global risk managers rate business interruption from financial failure as the most prevalent risk in their supply chains. This concern is not misplaced: according to the U.S. Small Business Association, 50% of small businesses fail within the first five years, and corporate credit risk has increased steadily since 2017. Learn more about the financial risk factors that impact your supply chain and what you can do to mitigate them.
Foreign ownership, control, or ownership (FOCI) risk, also called jurisdictional risk, is the analysis of geopolitical tensions, national security requirements, export control regulations and critical asset protection that impact a supplier, product, customer or supply chain. Analysis of FOCI encompasses assessing the extent to which foreign interests can control or influence a company, its supply chains, and its third parties. This scrutiny is crucial to safeguarding sensitive technologies, intellectual property, and infrastructure, as it helps identify potential risks, vulnerabilities, and conflicts of interest that could compromise national security or economic interests. Here’s a comprehensive view of all the factors that make up FOCI risk.
Environmental, social and governance (ESG) expectations are rising across investors, consumers, regulators, and financial reporting bodies. However, most programs lack ongoing ESG risk monitoring and visibility into their upstream suppliers — who pose significant risks. Survey and self-reporting information-gathering approaches are slow, quickly outdated, and provide a biased and incomplete view upon which many key risk decisions are based. Risk exposure multiplies at each tier within your supply chain ecosystem through the unknown reliance on sub-tier suppliers who might be involved in forced labor, experience data breaches or engage in poor environmental practices. Learn more about ESG risk indicators and how you can proactively minimize these risks.
This supply chain risk dimension covers reputational, criminal, and regulatory (RCR) risks across the supplier ecosystem. Maintaining regulatory compliance across fragmented jurisdictions and through a wave of new compliance legislation, regulations and policies that govern how companies manage suppliers, supply chains and customers, has become incredibly challenging. Regulatory compliance failures can lead to fines, penalties or criminal prosecution and can be damaging to a company’s brand. Whether or not these risks stem from your own operations or those of your supply chain, the impact to your reputation, brand and bottom line will ultimately be the same. Find out more about RCR risks so that you can identify, assess and mitigate them ahead of time.
Operational risk spans a wide variety of different categories, including geopolitical and geoeconomic risk, the climate variability impact on the physical location of an organization, counterfeits, and potential alternative suppliers. To prevent disruptions to you or your customers, it’s necessary to understand the operational health of all existing (and potential) suppliers and intermediaries in your supply chain. The scope of understanding should include company leadership, financial stability, compliance with regulations, hardware and software integrity, geographic concerns, and labor issues, among other factors. Continuous monitoring of operational risk indicators from the following categories is key to reducing potential losses resulting from inadequate or failed internal processes or unexpected external events:
- Hardware Counterfeit & Compromise Reporting
- Labor Issue Reporting
- On-Time Delivery
- Quality Metrics
- Mass Layoffs
- Corporate Restructuring
- Leadership Changes
- Liquidity Problems, Bankruptcy
- Noncompliance with Laws, Regulations
- Energy Scarcity
- Health & Safety Issues
- Facility Issues
- Product Quality
- IT & Business Process Certifications (like ISO Certifications)
- Financial Stability
- Data Breaches
- Software Integrity
- Alternative Suppliers
- Predictive Obsolescence
- Certification & Awards
- M&A Activity
- Sanctions
Exiger’s Cyber Risk model gives organizations a smarter, more complete view of which suppliers or third parties are most likely to suffer a cybersecurity incident or breach. It brings together three powerful data sets that, like puzzle pieces, reveal the full picture of cyber risk:
- Exiger Cyber Hygiene Assessment uses over 200 technical indicators—from patching cadence to DNS health to objectively monitor the cybersecurity hygiene of organizations (including their vendors) and gauge whether their security posture is improving or deteriorating over time.
- Exiger Breach Intelligence, By incorporating both recent and historical cyber incidents, this model provides a comprehensive assessment of an entity’s cyber risk exposure and likelihood of future breaches.
- Exiger Cyber Resilience Evaluation goes deeper into organizational and human factors—industry risk, security leadership, and certifications—to assess how prepared an entity is to withstand and respond to a cyber incident.
Together, these three dimensions move beyond traditional cybersecurity ratings to deliver a real-world, AI-powered prediction of breach likelihood—giving Exiger customers the insight they need to stay ahead of cyber threats. Learn more about how Exiger helps organizations to vet cyber risk in third parties and supply chains.
Product risk occurs when there’s a lack of transparency in your supply chain due to siloed data, incompatible systems across an enterprise, or the outsourcing of parts and raw materials. This results in the inability to monitor, influence and control n-tier supplier relationships as well as the components and material-inputs that go into your products — things like metals, electronics, plastics, chemicals and inactive or active ingredients. This can lead to a wide range of supply chain issues, including but not limited to: product recalls, late deliveries, lengthy lead-times, cost-overruns, unexpected supply disruptions and compliance violations. The first step to mitigating long-term product risk is to map both the entities involved in the manufacture, assembly and distribution of them, as well the item-level bills of material they are made of. Using a variety of highly specialized methods to map product attributes and a plethora of public and private data sources, you’ll be able to uncover hidden tiers of supply, n-tier supplier dependencies, countries of origin, and lead-times at each node of an extended enterprise — empowering your efforts to lower product cost, improve service levels, comply with regulations, and mitigate risk. To mitigate product risk effectively, consider a solution that can help you forecast, monitor, track, and trace the following:
- Material Input to End-Product
- Material, Processing, and Quality Specifications
- Lead-Times at Each Supply Chain Node
- Rare Earth Mineral Content
- N-Tier Dependencies
- Counterfeit Risk
- Part Compliance (REACH, ROHS, Lead-Free, etc.)
- On-Time Delivery/Recall History
- Quality Metrics
- Sole-Source vs Multi-Source
- Elemental Exposure
What Are the Outputs and Deliverables of the Playbook?
The Supply Chain Product Assurance Playbook is aligned to requirements in numerous U.S. Government regulations and directives, including the Department of Defense Supply Chain Risk Management Framework, the Department of Energy Supply Chain Cybersecurity Principles, Executive Orders 14028 (Compilation and Maintenance of SBOMs) and 14017 (Onshoring of Critical Product Manufacturing).
Additionally, the risk assessment and mitigation services described above enable compliance with various U.S. and European supply chain regulations, including the Uyghur Forced Labor Prevention Act, the German Supply Chain Act, the CHIPs Act, the European Critical Raw Materials Act, and the EU Cyber Resilience Act.
Frequently Asked questions
Can I participate in the Product Assurance Playbook if my data is Controlled Unclassified Information (CUI)?
The Supply Chain Product Assurance Playbook process is suitable for any industry, including energy, telecommunications, defense, healthcare, and the U.S. Government. Exiger’s Federal Cloud, a FedRAMP Moderate Authorized platform, ingests, aggregates, and analyzes bills of materials (BOMs) and parts data marked as Controlled Unclassified Information (CUI) so that companies delivering mission-critical hardware and software products can engage in the Playbook process with confidence.
What makes the Product Assurance Playbook unique compared to other solutions?
The Product Assurance Playbook is the only solution that provides a complete understanding of the entity and component/material level of both physical and software supply chains to illuminate risks that would go undetected by other solutions. The powerful context from a provides hyper relevance to cut through the noise and find true risk – even for scaled enterprises with large supply bases and datasets.
Ready to Fortify Your Supply Chain?
Exiger can help you build trusted, resilient supply chains and demonstrate the integrity of hardware and software products.
The Supply Chain Product Assurance Playbook leverages Exiger’s AI technology and The Chertoff Group’s cybersecurity and regulatory expertise to map, monitor, and mitigate supply chain risks, driving measurable risk reduction and building trust.
.png)
