Preliminary Considerations of Paths to Enable Improved Multi-Directional Sharing of Supply Chain Risk Information [open pdf - 335KB]
Alternate Title: Working Group One: Extension Period Report: Preliminary Considerations of Paths to Enable Improved Multi-Directional Sharing of Supply Chain Risk Information
From the Executive Summary: "The purpose of this report is to offer subject matter expert research on legal and policy considerations for private enterprise or government utilization in addressing liability limitations. It was determined that limiting private companies' and government liability would facilitate the most effective sharing of supply chain risk information (SCRI) with the government or between companies. Improving the omni-directional supply chain threat information sharing among the federal government and private industry is necessary to obtain actionable information that could mitigate threats to the nation's Information and Communications Technology (ICT) supply chain. The report was provided to the government as the consensus input of non-Federal members and does not reflect the official policy or position of the Federal government or its official representatives."
U.S. Cybersecurity and Infrastructure Security Agency: https://www.cisa.gov/