Supply Chain Security: The Office of the National Cyber Director Perspective

### Overview In this presentation, Andrew Pac, Senior Policy Advisor for supply chain and technology security at the Office of the National Cyber Director (ONCD), outlines the White House's approach to supply chain risk management. Established in 2021 within the Executive Office of the President, the ONCD serves as the principal advisor to the President on cybersecurity policy and strategy. Pac discusses how supply chain security spans across the National Cybersecurity Strategy (NCS) and its corresponding Implementation Plan, highlighting two fundamental shifts: rebalancing the responsibility of defending cyberspace away from end users toward capable ecosystem leaders, and realigning market incentives toward long-term security investments. He details key initiatives including software security, memory safe programming languages, software measurability, and semiconductor hardware security.

### Key Topics - **National Cybersecurity Strategy (NCS) and Implementation:** Released in March 2023, the NCS outlines five pillars across 27 strategic objectives. In July 2023, the ONCD published an implementation plan containing 69 initiatives led by 18 departments and agencies. Supply chain security touches all five pillars, including shaping market forces through Federal Acquisition Regulation updates, exploring software liability frameworks, advancing Software Bills of Materials (SBOMs), funding cybersecurity research, and fostering international partnerships. - **Back to the Building Blocks Report:** Published by ONCD in February, this report targets upstream actions to benefit the digital ecosystem, centering on two primary software initiatives: reducing whole vulnerability classes via memory safe languages and establishing empirical software security metrics. - **Memory Safe Programming Languages:** Memory safety issues account for an estimated 70% to 75% of software vulnerabilities. ONCD strongly advocates for adopting memory safe languages in new products from day one, while acknowledging that complete code base migrations in specialized environments (such as space systems or operational technology) require careful prioritization due to safety, reliability, and minimal maintenance windows. - **Software Metrology:** Citing findings from the UK National Cyber Security Centre (NCSC) and NIST, Pac emphasizes the severe information asymmetry between software vendors and buyers. Because software is dynamic and lacks standardized empirical quality metrics, organizations struggle to evaluate cybersecurity quality. ONCD encourages researchers and industry to address this challenge without falling into Goodhart's law traps where arbitrary numerical thresholds become mere compliance targets. - **Semiconductor and Hardware Security:** Driven by the CHIPS and Science Act (which allocated over $50 billion for semiconductor R&D, manufacturing incentives, and workforce development), the administration is expanding secure development practices from software into hardware. Key efforts include NIST's February 2024 workshop to build a standardized secure development framework and collaboration with the industry trade organization SEMI to create a manufacturing profile based on the NIST Cybersecurity Framework (CSF) 2.0.

### Technical Details - **Memory Safety Impact:** Transitioning from memory-unsafe languages (such as C and C++) directly eliminates pervasive memory management flaws. ONCD collaborates with CISA, NSA, FBI, and international partners to push adoption across the open-source and commercial ecosystems. - **Standards and Attestation:** Upstream software development relies on the NIST Secure Software Development Framework (SSDF) and recent CISA/OMB attestation forms, allowing consumers and government buyers to verify adherence to secure development standards. - **Hardware & Manufacturing Profiles:** NIST and SEMI are tailoring NIST CSF 2.0 specifically to the semiconductor supply chain and fabrication facilities to defend against physical and cyber threats across the microelectronics lifecycle.

### Takeaways - Supply chain risk cannot be eliminated overnight; ONCD views security as a continuous effort to "buy down" risk over multi-year horizons. - Federal policy emphasizes upstream intervention, urging vendors to build products that are secure by design rather than pushing defensive burdens onto end users. - Transitioning legacy operational technology (OT) and safety-critical infrastructure to new languages requires balancing security gains against operational risk, focusing on gradual adoption in new product designs. - Successful implementation depends on deep public-private collaboration, spanning industry standards groups, academic researchers, and interagency partners like NIST, CISA, and the Department of Commerce.