The White House is reviewing how agencies report on their cyber supply chain security programs, with new metrics expected in the “near term” to get a better picture of shared risks, especially those related to foreign adversaries. The White House Office of the Federal Chief Information Officer has been tasked with reviewing how agencies align with National Institute for Standards and Technology guidelines on “Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.” Those standards provide guidance on evaluating risks associated with products and services “that may potentially contain malicious functionality, are counterfeit, or are vulnerable due to poor manufacturing and development practices within the supply chain,” according to NIST. Cheri Benedict, senior cyber supply chain advisor within the federal CIO’s office, said governmentwide compliance mechanisms for those NIST standards are due for an upgrade. They were last updated in the wake of the Strengthening and Enhancing Cyber-capabilities by Utilizing Risk Exposure (SECURE) Technology Act of 2018. “We are now reviewing all practices and procedures as it relates to that to then inform the way forward,” Benedict said during a Tuesday webinar hosted by the Intelligence and National Security Alliance. “And in in the near future, agencies can expect a revamp of that data collection that tries to capture the status and perspective of maturity of their program, and moreover, not just that, but really helps us realize how we can better partner to move forward in common against threats.” Benedict said the ongoing review of governmentwide standards is emphasizing “the sharing perspective and the perspective of shared risk.” “There are many different risks, and we want all of it to be brought to bear if there’s a desire and shared perspective, but we especially focus on adversarial related risk, and that can take different forms and fashions,” she