Supply Chain
Why Your Vendor Might Be Your Biggest Risk
SolarWinds, Log4j, MOVEit — all supply chain attacks. In 2025, SCRM is no longer optional. CISSP candidates must understand third-party risk, vendor assessment frameworks, and contractual security requirements.
## The SolarWinds Wake-Up Call
In December 2020, nation-state actors compromised SolarWinds' build system and pushed malicious updates to 18,000+ organizations. This single event changed Domain 1 forever.
Key lesson: **You are only as secure as your weakest supplier.**
## The 8 Components of Modern SCRM
1. Vendor inventory & classification
2. Onboarding risk assessments
3. Continuous monitoring (CVSS, breach history, financial health)
4. Contractual security requirements (Right to Audit, SLA, incident notification < 24h)
5. Concentration risk analysis
6. Fourth-party & Nth-party visibility
7. Exit strategy & data destruction
8. Insurance & liability transfer
Pro Tip: Use frameworks like NIST 800-161, ISO 27036, or the CISA SCRM Essentials.
Clock Lessons in Domain 1 (CISSP)
Recommended reading order:
Your Progress in This Domain: 6 of 6 lessons completed 100%