Publications

China, Russia, and other potential adversaries are increasing their efforts to corrupt the supply chains upon which the electric grid and other infrastructure sectors depend. Valuable initiatives are underway to strengthen supply chain risk management (SCRM). Yet, despite these measures, the US intelligence community warns that the growing scale and sophistication of attacks on the supply chain “are placing entire segments of our government and economy at risk.” Similar challenges confront Israel, the United Kingdom, and other US security partners.

At present, infrastructure owners and operators lack a compressive, stakeholder-driven process to certify that crucial hardware and software products are even minimally scrubbed of malware and other means of adversary exploitation. Establishing such a certification process contribute enormously to cyber resilience, especially if government agencies can provide threat information and other forms of support for the initiative.

The Cyber Product International Certification (CPIC) initiative proposed by the Electric Infrastructure Security (EIS) Council will help meet these challenges. CPIC could add even greater value for infrastructure resilience by including measures to certify products against intentional electromagnetic interference (IEMI).