ICT-SCRM stands for Information and Communications Technology Supply Chain Risk Management. It is the discipline of identifying, assessing, and reducing risk across the full lifecycle of technology products and services, including hardware, software, cloud platforms, updates, and the suppliers behind them. In practice, ICT-SCRM asks not only whether a tool works, but who provides it, how it is built, how it is updated, and what dependencies it brings into a trusted environment.
This matters in cyber security because attackers often target the supply chain instead of the endpoint. A compromised vendor, malicious update, unsafe plugin, or unverified service can bypass normal defenses and reach many systems at once. Defenders use ICT-SCRM to support procurement reviews, allowlisting, vendor due diligence, logging, and policy decisions about what may run on managed devices. In sensitive environments, even an AI service may be restricted if its provenance, update path, or data handling cannot be sufficiently verified.