Supply Chain & Third-Party Risk

1. Approach

We treat suppliers, subcontractors, teaming partners, and software components as part of our attack surface. Our approach draws on NIST SP 800-161 (cyber supply chain risk management) and the contract clauses federal customers flow down.

2. Selecting and Vetting Partners

• Active SAM.gov registration, with UEI and CAGE confirmed, and a check for exclusions
• Relevant past performance and capability for the proposed scope
• Security posture appropriate to the data they will touch, assessed with a questionnaire and, for higher-risk work, supporting evidence
• Ownership and foreign-influence considerations where the contract requires them
• Financial and operational stability for the period of performance

3. Contract Requirements and Flow-Downs

Subcontracts and teaming agreements carry the security terms the prime contract requires, which commonly include:

• FAR 52.204-21, basic safeguarding of covered contractor information systems
• DFARS 252.204-7012, -7019, -7020, and -7021, where covered defense information or CMMC applies
• FAR 52.204-25, the prohibition on certain telecommunications and video surveillance equipment
• Incident-reporting duties and timelines, and the right to assess

4. Tiering and Ongoing Monitoring

Vendors are tiered by the sensitivity of data and access they have. Higher tiers get deeper initial review and more frequent reassessment. We re-review when a vendor's service, ownership, or security posture changes, and we remove access and recover or destroy data when a relationship ends.

5. Security in Procurement

When we help customers buy IT or security products and services, we advise including risk-based security requirements in acquisition plans, statements of work or objectives, evaluation factors, and service-level agreements, and weighing total cost of ownership, not only price.

6. Software Bill of Materials

We keep an inventory of the third-party software our own web assets use. For customer software work, we support SBOM generation and vulnerability tracking aligned with CISA and NTIA minimum-element guidance.

7. This Website's Components

All front-end libraries and fonts are served from this site rather than from third-party CDNs. Components and versions at the time of writing:

8. Questions

Contact contact@beeasyenterprises.com for teaming and vendor-assessment requests.