Oversight and Governance · OG-WRL-017
Cybersecurity Supply Chain Risk Management
From NICE Framework Components v2.2.0
Description
From NICE Framework Components v2.2.0
Free · NICE Framework Components v2.2.0Responsible for developing cybersecurity supply chain risk management (C-SCRM) policies, processes, and procedures to identify, assess, protect against, and respond to cybersecurity risks throughout the supply chain, and for advising other stakeholders within an enterprise about supply chain risks.
Tasks
From NICE Framework Components v2.2.0, open one for the AI skills Workforce Automation maps to it
Free · NICE Framework Components v2.2.0T1069 Evaluate organizational cybersecurity policy regulatory compliance
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1189 Determine if contracts comply with funding, legal, and program requirements
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1266 Recommend risk mitigation strategies
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1279 Prepare audit reports
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1298 Communicate situational awareness information to leadership
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1344 Determine if procurement activities sufficiently address supply chain risks
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1358 Determine the effectiveness of organizational cybersecurity policies and procedures
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1366 Identify supply chain risks for critical system elements
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1369 Determine if acquisitions, procurement, and outsourcing efforts address cybersecurity requirements
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1399 Develop supply chain, system, network, and operational security contract language
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1407 Correlate threat assessment data
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1444 Determine if products comply with cybersecurity requirements
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1497 Determine supply chain cybersecurity requirements
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1537 Determine if cybersecurity training, education, and awareness meet established goals
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1572 Inventory technology resources
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1586 Conduct cybersecurity risk assessments
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1602 Advise stakeholders on supply chain risk management
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1621 Prepare supply chain security reports
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1623 Develop cybersecurity supply chain risk management policy
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1650 Develop cybersecurity success metrics
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1863 Develop information sharing strategic plans
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2056 Conduct supplier risk assessments
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2057 Develop organizational C-SCRM plans
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2058 Monitor supply chain risk exposure
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2059 Develop cybersecurity supply chain risk management policies and procedures
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2060 Communicate cybersecurity requirements to suppliers
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2061 Integrate C-SCRM activities throughout the software development life cycle (SDLC)
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2062 Determine effectiveness of risk mitigation strategies
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2063 Develop an acquisition strategy that reduces organizational risk exposure
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2064 Integrate C-SCRM into organizational workforce training
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2065 Establish enterprise-wide C-SCRM policies
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2066 Establish internal checks and balances to ensure compliance with C-SCRM security and quality requirements
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2067 Integrate C-SCRM into incident response functions
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2068 Protect C-SCRM plans and policies from unauthorized disclosure and modification
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2069 Validate that procured systems and system components are genuine and unaltered
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2070 Document supply chain security, resilience, and dependability requirements
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2071 Recommend cost-effective supply chain security controls or control enhancements
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2072 Evaluate offers to ensure conformance with C-SCRM requirements
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yet
Knowledge
From NICE Framework Components v2.2.0
Free · NICE Framework Components v2.2.0- K0647Knowledge of data visualization tools and techniques
- K0650Knowledge of supplier assessment criteria
- K0654Knowledge of target audience requirements
- K0664Knowledge of stakeholder management
- K0667Knowledge of contracts
- K0668Knowledge of contract management
- K0669Knowledge of contractor management
- K0675Knowledge of risk management processes
- K0683Knowledge of cybersecurity vulnerabilities
- K0687Knowledge of business operations standards and best practices
- K0696Knowledge of digital forensic data principles and practices
- K0724Knowledge of incident response principles and practices
- K0735Knowledge of risk management models and frameworks
- K0771Knowledge of system life cycle management principles and practices
- K0803Knowledge of supply chain risk management principles and practices
- K0818Knowledge of new and emerging cybersecurity risks
- K0819Knowledge of import and export control laws and regulations
- K0820Knowledge of supply chain risks
- K0822Knowledge of risk tolerance principles and practices
- K0836Knowledge of threat assessment principles and practices
- K0868Knowledge of process improvement principles and practices
- K0869Knowledge of process maturity models and frameworks
- K0912Knowledge of sustainment principles and practices
- K0922Knowledge of the acquisition life cycle models and frameworks
- K1019Knowledge of operations security (OPSEC) principles and practices
- K1076Knowledge of risk scoring principles and practices
- K1110Knowledge of acquisition cybersecurity requirements
- K1126Knowledge of cost constraints
- K1137Knowledge of cybersecurity requirements
- K1172Knowledge of mission requirements
- K1173Knowledge of multilevel security requirements
- K1183Knowledge of organizational cybersecurity policies and procedures
- K1190Knowledge of organizational risk levels
- K1208Knowledge of risk acceptance and documentation
- K1212Knowledge of security controls
- K1217Knowledge of software and systems engineering life cycle standards
- K1252Knowledge of high value asset characteristics
- K1263Knowledge of notification policies and procedures
- K1274Knowledge of threat modeling tools and techniques
- K1279Knowledge of threat-informed defense
- K1287Knowledge of change management processes
- K1288Knowledge of OT cybersecurity compliance requirements and best practices
- K1307Knowledge of OT inventory principles and practices
- K1331Knowledge of intellectual property laws and regulations
- K1346Knowledge of supply chain fundamentals
- K1347Knowledge of supplier data and documentation
- K1348Knowledge of risk prioritizations
- K1349Knowledge of software bills of materials (SBOMs)
- K1350Knowledge of sensitive data handling requirements
- K1351Knowledge of anti-tampering policies and procedures
- K1352Knowledge of anti-counterfeit policies and procedures
- K1353Knowledge of foreign laws that may introduce supply chain risks
- K1354Knowledge of hardware bills of materials (HBOMs)
- K1355Knowledge of firmware bills of materials
- K1356Knowledge of contract manufacturing principles and practices
Skills
From NICE Framework Components v2.2.0
Free · NICE Framework Components v2.2.0- S0384Skill in applying standards
- S0385Skill in communicating complex concepts
- S0386Skill in communicating verbally
- S0387Skill in communicating in writing
- S0401Skill in collecting data
- S0404Skill in conducting market research
- S0406Skill in developing policy plans
- S0432Skill in coordinating cybersecurity operations across an organization
- S0460Skill in verifying contractor compliance with contracts
- S0461Skill in integrating security requirements and contracts
- S0462Skill in integrating information security requirements in the acquisitions process
- S0479Skill in evaluating supplier trustworthiness
- S0480Skill in evaluating product trustworthiness
- S0531Skill in assessing security hardware and software
- S0579Skill in preparing reports
- S0640Skill in performing regression analysis
- S0665Skill in creating policies that reflect legal, regulatory, and organizational requirements
- S0666Skill in defining performance objectives
- S0686Skill in performing risk assessments
- S0725Skill in performing network visualization
- S0756Skill in incorporating feedback
- S0769Skill in defining progress indicators
- S0772Skill in maintaining planning documents
- S0790Skill in monitoring status
- S0797Skill in negotiating vendor agreements
- S0800Skill in analyzing organizational patterns and relationships
- S0810Skill in responding to threat reports
- S0812Skill in performing supply chain analysis
- S0817Skill in building internal and external relationships
- S0827Skill in communicating with internal and external stakeholders
- S0854Skill in performing data analysis
- S0861Skill in performing gap analysis
- S0877Skill in performing quantitative analysis
- S0878Skill in performing risk analysis
- S0900Skill in analyzing information from multiple sources
- S0917Skill in forecasting likely impacts on mission or business functions resulting from adversity
- S0930Skill in defining impact tolerance statements
- S0959Skill in building multidisciplinary teams
- S0960Skill in designing governance structures
- S0961Skill in selecting supply chain controls
- S0962Skill in applying supply chain controls
- S0963Skill in identifying supply chain risks in common business practices
- S0964Skill in supply chain mapping
- S0965Skill in performing geopolitical risk analysis
Workforce Automation analysis, not part of the source
O*NET jobs this role maps to
WFA · Part of the paid plan when accounts openJobs from the ETO-CSET NICE/O*NET crosswalk (2024), with the share of each job’s detailed work activities (DWAs) that has a mapped AI skill. We haven’t mapped AI skills to this role’s own tasks yet; until then, these jobs show the coverage the role reaches through the occupations it maps to.
No jobs map to this role.
Equivalents
O*NET jobs
Mapped to this role by the ETO-CSET NICE/O*NET crosswalk (2024); jobs from O*NET 30.3
Free · O*NET 30.3No O*NET job maps to this role.
DCWF work roles
From DoD DCWF Tool v5.3 (2026-09-25), linked by its NCWF ID or NICE's OPM code
Free · DoD DCWF Tool v5.3 (2026-09-25)No published DCWF equivalent.