Supply-Chain Risk Management (SCRM) is the practice of identifying, assessing, and reducing security risk introduced by hardware, software, services, and vendors. It looks beyond the product itself and asks whether the component was built, delivered, updated, and supported in a trustworthy way. In cyber security, this matters because an attacker may compromise a system before it is even deployed, by inserting malicious code, tampering with firmware, abusing remote access, or exploiting a supplier’s weak controls.
SCRM is especially important in critical infrastructure, where a trusted device can affect safety and availability as well as data. Defenses include inventorying suppliers, verifying authenticity, checking provenance, limiting vendor access, reviewing update channels, and requiring secure development and maintenance practices. In real environments, SCRM shows up in procurement reviews, firmware validation, software bill of materials checks, and third-party risk assessments. The goal is simple: trust should be earned and verified, not assumed.