1. Home
  2. |Insights
  3. |DoD and GSA Take Aim at Supply Chain Risks

DoD and GSA Take Aim at Supply Chain Risks

Client Alert | 1 min read | 01.15.21

The Department of Defense (DoD) recently implemented additional procedures for the mitigation of cybersecurity risks in its supply chain. Designed to identify and mitigate cybersecurity and related supply chain risks throughout a program’s lifecycle, DoD Instruction 5000.90, Cybersecurity Acquisition Decision Authorities and Program Managers, requires program managers to:

  • Assess contractors’ cybersecurity posture, including, where applicable, verifying compliance with the DoD’s newly introduced Cybersecurity Maturity Model Certification (CMMC);
  • Consider the extent to which contractors have experienced “significant” incidents resulting in network breaches or data loss;
  • Avoid program requirements that may necessitate the use of contractors or suppliers that are owned or controlled by a foreign adversary government or are subject to the jurisdiction of a foreign adversary government;
  • Manage any supply chain risks associated with foreign ownership, control, or influence (FOCI); and
  • Mitigate supply chain risks using a framework that prescribes escalating risk management actions across four risk tolerance levels.

Alongside the DoD, the General Services Administration (GSA) recently introduced, as part of a draft solicitation for the Polaris small business government-wide IT contract, its own Vendor Risk Assessment Program (VRAP). According to the draft solicitation, the VRAP is designed to identify, assess, and monitor supply chain risks associated with FOCI, cybersecurity, and other factors, such as financial performance. 

Contacts

Insights

Client Alert | 4 min read | 07.02.25

FTC Orders Divestitures in Retail Fuel Outlet Deal and Signals a Return to More Standard Remedy Discussions

Merger consent orders are back at the FTC, and the FTC’s most recent action showcases how the current leadership is analyzing divestiture proposals. Last week, the FTC approved a proposed consent agreement in Alimentation Couche-Tard Inc.’s (ACT) acquisition of retail fuel outlets from Giant Eagle, Inc. that paired standard retail divestitures with a “prior notice” requirement that ACT notify the agency of future acquisitions in certain markets regardless of size. This FTC has signaled greater acceptance of remedies than the prior administration, and this most recent consent puts that on display, with Commissioner Meador providing merging parties guidance on designing effective remedies....

View All Insights