Category: News

By Geraint John

Since the U.S.-China trade war kicked off in early 2018, “supply chain resilience” has become a top agenda item for procurement leaders, company bosses and legislators alike.

The case for resilience has been massively strengthened during this period by the COVID-19 pandemic, severe semiconductor shortages, and most recently Russia’s invasion of Ukraine.

But what started out as a largely operational effort by businesses to shore up fragile supply chains is in danger of being subsumed by political considerations, as governments pour money into favored firms on home soil in an attempt to reverse globalization.

In this febrile atmosphere, advocates of operational resilience need to guard against attempts to narrow its focus unduly to national interests and protectionist trade policies.

Globalization & bringing production ‘back home’

Recent years have seen a growing debate about whether globalization — a 30-year-plus stretch in which hundreds of thousands of firms shifted production to far-flung destinations in search of cost efficiencies — is in retreat.

Bringing sourcing and manufacturing activity back to home countries (onshoring or reshoring) or neighboring ones (nearshoring) is seen as proof that global supply chains are not the panacea they once were.

After several false starts, in which there has been plenty of talk but relatively little action, Wall Street is now pointing to evidence that suggests a reverse trend may finally be real. 

Last month, analysts at Bank of America and Barclays were among those who noted a growing number of references to reshoring by CEOs and other senior executives at S&P 500 companies during second-quarter earnings calls.

Data from Bloomberg shows a 1,000% increase in use of the terms onshoring, reshoring, and nearshoring in these calls compared with pre-pandemic levels (see chart).

The business drivers for changing global operating models in this way include:

• A closing of wage differentials between offshored locations — especially China — and home nations
• More expensive logistics costs to transport components and finished goods by air and sea
• Extended lead times and shortages of materials and labor caused by COVID lockdowns and other disruptive events
• The need to respond more quickly to evolving customer requirements in local markets 

An expanding national security agenda impacts operational resilience

At the same time, governments in the U.S., Europe and elsewhere are pushing for the rebuilding of domestic supply chains in the name of national security and self-sufficiency.

In practice, this means reducing dependence on China and Russia as tensions escalate and a largely stable and benign era of international free trade is fractured by the battle for global economic and geopolitical supremacy.

Russia’s war in Ukraine highlighted just how reliant many countries are on it for supplies of oil and natural gas, as well as many critical industrial and agricultural commodities.

China, meanwhile, remains the world’s preeminent manufacturing base, and an electronics powerhouse that dominates supply chains for everything from 5G networks to lithium-ion batteries.

Both countries have been subjected to an ever-growing list of Western sanctions and export controls, with Russia essentially closed for business and China’s access to U.S. and European chip-making equipment and related technologies heavily restricted.

U.S. House Speaker Nancy Pelosi’s controversial visit to Taiwan at the beginning of August shone a spotlight on that island’s almost total control of advanced semiconductors — used not only in the latest smartphones, but also cutting-edge military systems — and its vulnerability to a Chinese takeover.

A&D semiconductor supply chains rely on Taiwan and China

An analysis of Interos’ global relationship platform data shows that:

• The major U.S. aerospace & defense (A&D) companies each have as many as 85 direct (tier-1) relationships with semiconductor suppliers 
• The vast majority of these tier-1 relationships are with U.S.-headquartered companies, led by the likes of Intel, Broadcom and Nvidia 
• At the tier-2 level, big Taiwanese chip makers such as Taiwan Semiconductor Manufacturing Co. (TSMC), Advanced Semiconductor Engineering (ASE) and United Microelectronics Corporation (UMC) have hundreds of connections to U.S. A&D supply chains  
• SMIC, China’s largest semiconductor manufacturer, has over 300 connections to tier-1 suppliers serving U.S. A&D customers, and there are many other Chinese-owned suppliers present in these supply chains at tiers 2 and 3

In a survey conducted by Interos in the first quarter of 2022, U.S.-based respondents in A&D said that, on average, almost two-thirds (64%) of their suppliers were located outside North America, with 16% in Asia (see chart below).

They expected just over half (53%) of these contracts to be reshored or nearshored during the next three years.

Public subsidies incentivize regional production

Regionalizing semiconductor manufacturing to reduce over-concentration in Taiwan makes sense to the West for risk diversification and national security reasons — particularly in the light of China’s extensive live-fire military drills in the area following Pelosi’s visit.

Manufacturers such as TSMC, Intel, Samsung, and Micron are being showered with billions of dollars in public subsidies to build fabs in the U.S., buoyed by the recently passed CHIPS and Science Act. 

It’s a similar story for the lithium-ion batteries needed to power a new generation of electric vehicles (EVs) and clean energy solutions. 

The climate measures of the new Inflation Reduction Act promise over $15 billion in subsidies for EV and other manufacturers to expand capacity within the U.S. 

As it stands, this legislation goes further in a bid to reduce dependence on China by withdrawing consumer tax credits from vehicles that contain Chinese battery components (in other words, most of them).

In practice, however, replicating entire supply chains onshore, whether for silicon chips or lithium-ion batteries, is likely to be prohibitive for both cost and time reasons, putting operational resilience in jeopardy.

An in-depth article by Nikkei Asia lays bare the fact that semiconductor supply chains are reliant on a complex network of specialist sub-tier suppliers, not all of whom are going to set up shop next door to shiny new wafer plants.

The U.S. government appears to accept that domestic supply chains have their limits, judging by recent speeches from top officials.

Treasury Secretary Janet Yellen and Trade Representative Katherine Tai are among those who have been busy promoting the virtues of “friendshoring” — doing business only with trusted allies and not authoritarian regimes.

While this concept, and government intervention to support domestic production, seem like sensible strategies to boost supply chain resilience in critical industries, they have come under fire from a number of respected commentators.

Earlier this month, Financial Times trade columnist Alan Beattie questioned whether fashioning an anti-China trading bloc will really be that simple and argued that subsidies and tax credits have the potential to distort markets and increase prices.

And a cover story in The Economist on reinventing globalization warned: “The danger is that a reasonable pursuit of security will morph into rampant protectionism.”  

Resilience is about more than security

Where does all of this leave procurement, supply chain, and operational resilience leaders? 

For starters, they should be wary of attempts by some politicians and journalists to equate supply chain resilience solely with re/near/friendshoring and national security (including in the otherwise excellent Nikkei article mentioned earlier).

Research by the International Monetary Fund (IMF), discussed in a previous blog, concluded that diversifying sources of supply abroad is a more effective way of building resilience than concentrating it at home. 

This finding is supported by a newly published Gartner survey of 400 global supply chain leaders, which found that diversification away from China to other low-cost countries in Asia was more prevalent than nearshoring to developed markets.  

A balanced view of supply chain resilience in a changing trade environment comes from Christine Lagarde, a former IMF boss who is currently President of the European Central Bank.

In a speech in Washington, DC, in April, Lagarde pointed to “three distinct shifts in global trade”:

1. Reducing dependence and geographic concentration risk by diversifying suppliers, stockpiling essential materials, and operating “just-in-case” supply chains.
2. Focusing less on cost efficiency and more on supply chain security through industrial policies and other government measures.
3. Developing regionalized import-export and risk-sharing models where the first-choice “rules-based multilateral trading system” no longer functions effectively.

Lagarde argued that the goal for Europe should be “open strategic autonomy” — defined as striking “a careful balance between insuring against risk in areas where our vulnerabilities are excessive and avoiding protectionism”.

At a time when the benefits of globalization and free trade — including prosperity, innovation, openness, and integration—– are under attack, this is a message that the U.S. and other developed economies would be wise to embrace.

To learn more about how the Interos platform can help your firm face challenges relating to globalization, supply chains, and operational resilience, visit interos.ai.

By Geraint John

Global sales of electric vehicles (EVs) hit the accelerator pedal last year, with their market share speeding past 10% of new car registrations in the first half of 2022.

That’s great news for the planet, since passenger cars account for more than 40% of total carbon dioxide emissions annually worldwide, whereas EVs emit zero.

But from a supply chain perspective, the rapid growth of EV sales poses two particularly significant and worrisome challenges:

1. The supply of key raw materials used to make rechargeable lithium-ion (Li-ion) batteries – the most important component in every EV – is not expected to keep up with demand.
2. The processing of these raw materials and battery production are both dominated by China, at a time when geopolitical tensions are rising and developed economy governments want to reduce their strategic dependence on the country.

The importance of building a strong EV supply chain strategy

In recent months, the CEOs of several auto makers, including Tesla, Rivian and Stellantis, have spoken out about a looming supply shortage of Li-ion batteries during the next 3-5 years – one potentially far worse than the current semiconductor crisis.

Their concerns center around a projected deficit in the availability of lithium and cobalt – two of the main ingredients in battery cells – along with a lack of future capacity to refine these materials and manufacture the much higher battery volumes required.

Last week, the world’s biggest producer of lithium for EV batteries warned of a tight supply market for the rest of this decade.

High demand and constrained supply have already caused significant raw material inflation, particularly for lithium. Prices for battery-grade lithium carbonate are up 375% year on year, and 116% in 2022, according to Benchmark Mineral Intelligence (BMI).

Raw materials now make up 80% of the cost of a Li-ion battery, reports BMI – double the share in 2015.

This has forced auto makers to raise list prices for EVs, and at least temporarily halted the notion that lower battery costs will make EVs more affordable for consumers.

The EV battery supply chain is dependent on China and Russia

Concentration risk is also a major concern. The latest global mining data shows that extraction of cobalt, graphite and lithium are highly concentrated in the Democratic Republic of the Congo (DRC), China and Australia respectively, based on the Herfindahl-Hirschman Index.

The DRC, which produces 70% of the world’s cobalt supply, is tainted by the use of child labor. And the second biggest source of cobalt is Russia, which is also the leading producer of battery-grade nickel.

Concentration risk for Li-ion batteries becomes even more pronounced further downstream in the supply chain. A new report by the International Energy Agency (IEA) notes that China:

• Owns more than half of the world’s processing and refining capacity for lithium, cobalt and graphite.
• Controls 70% of global production capacity for cathodes and 85% for anodes – the two key battery components.
• Manufactures three-quarters of the world’s supply of Li-ion batteries, and accounts for 70% of new production capacity set to be added through 2030.

An Interos survey of 750 procurement executives in Q1 found that 85% were concerned that their supply bases were too concentrated in certain geographic regions, such as China.

A similar share of participants in the aerospace & defense (A&D) and IT & technology sectors – both also significant users of Li-ion batteries – took the same view.

Chinese producers are heavily embedded in key industry supply chains

An analysis of Interos’ global relationship platform data reveals that:

• Almost 300 A&D entities in the U.S., Europe and Japan have the leading Chinese lithium firms Ganfeng Lithium Co., Tianqi Lithium Corporation and Zijin Mining Group in their supply chains.
• China’s primary cobalt miner – and the world’s second largest after Glencore – China Molybdenum indirectly supplies a slew of leading automotive components, car manufacturing and A&D firms operating in Japan and China.
• Almost 167,000 U.S., European and Japanese firms have indirect (tier-2 or tier-3) relationships with Chinese cathode and anode components firms, notably Ningbo Shanshan, BTR New Materials Group Co., Shenzhen Capchem Technology Co. and Tianjin B&M Science and Technology Co.
• Almost 500 technology and automotive manufacturers in the U.S., Europe and Japan use the top three Chinese Li-ion battery makers, Contemporary Amperex Technology Co. (CATL), BYD and China Aviation Lithium Battery Co. (CALB).
• South Korean battery makers LG Energy Solution, Samsung SDI and SK Innovation are rated as “low risk” (average i-Score of 79), whereas Chinese battery makers BYD and CALB are rated “medium risk” (average i-Score of 63).

Alternative strategies deployed by governments and OEMs

The dependence on Chinese refining, component and battery manufacturers is of concern not only to companies, but also to many Western and Asian governments.

Last year the U.S. Department of Energy published a blueprint for lithium-based batteries. In the context of a market that is expected to grow 5-10 times in size by 2030, it calls for the development of a domestic supply chain to support EVs, electrical grid storage, aviation and national defense.

The plan includes more secure access to raw materials; the elimination of cobalt and nickel from battery formulas; and the expansion of onshore processing, cell production, pack manufacturing and recycling capacity.

Source: National Blueprint for Lithium Batteries, 2021-2030, Federal Consortium for Advanced Batteries

The European Commission unveiled a similar strategy back in 2018, while in Japan the Battery Association for Supply Chain was established last year, with 55 member firms spanning all industry segments, to develop policy recommendations.

Auto makers aren’t waiting around for national governments to reshape battery supply chains. Many are now pursuing their own strategies in an effort to head off future supply chain disruptions. The two main ones are:

• Direct sourcing from mining companies. During the past 12 months, Tesla has signed contracts with lithium, nickel and graphite miners, including BHP and Vale, as it ramps up its battery raw material purchasing. BMW and General Motors have each made multi-million dollar investments in lithium mining projects, while Ford, VW, Renault and Stellantis have all done their own lithium supply deals. GM has also signed a multi-year agreement for cobalt with Glencore.
• Diversification of battery manufacturing.S., European and Japanese OEMs are also extending their cell components and battery pack production capacity outside China. Suppliers Panasonic, LG Energy Solution and Samsung SDI have announced new battery manufacturing plants on the U.S. east coast. Redwood Materials, an electronics recycling specialist, is building a new cathode material plant in Nevada, close to Tesla’s Gigafactory. And Europe’s Northvolt is planning new factories in Germany and Sweden.

Changing battery chemistries is another strategy being pursued by auto makers such as VW and Tesla to improve range, lower costs and reduce dependence on raw materials such as cobalt. But, as with the development of new manufacturing plants, this will take several years to fully implement.

In the meantime, vertical integration – a characteristic of the early automotive pioneers, but out of fashion in recent decades – seems to be the order of the day, as the industry seeks to minimize its vulnerabilities and regain control of electronics supply chains.

CBP Implements UFLPA: The Newest Law Targeting Supply Chain Washing and ESG Violations

On Monday, the United States’ Uyghur Forced Labor Prevention Act (UFLPA) goes into effect. Focused on a controversial region in northwest China, the landmark law creates a presumption that any products “manufactured wholly or in part” in Xinjiang are made with forced labor. It bans all imports from the territory unless a company can prove otherwise.

The guidance sets out the US Customers and Border Protection (CBP) agenda of enforcement and prioritizes investment in supply chain visibility technology and “digital traceability.” It also explicitly bans US companies from importing any products from a list of 20 newly named Chinese companies (many of which are based in Xinjiang), unless the importer proves the goods were not made with forced labor. The list of restricted companies is expected to grow as further labor violations are uncovered, and as named companies adopt aliases to evade detection. Interos is adding these restricted entities to our platform to help customers ensure they’re not in violation.

The law is the latest and boldest attempt to combat an increasingly common practice known as supply chain washing – the concealment of critical information about how products and services are sourced and sold.

While bad actors are certainly responsible for a significant amount of supply chain washing, even companies that believe they are acting in good faith can inadvertently violate sanctions, restrictions, and export controls through hidden unknown relationships in their supplier or customer networks.

UFLPA Compliance: Concerns Over Supply Chain Washing, Supply Chain Visibility, Rise 

The implementation of the UFLPA comes at a time when outcry over supply chain deception is high, as much of the world witnesses China’s persecution of the ethnic minority Uyghur population in Xinjiang. The U.S. has described China’s treatment of Uyghurs as genocide.

The UFLPA is part of a series of growing global regulatory actions requiring organizations to act on ESG hazards in their supply chains.

Global supply chains could be significantly impacted by the new law, since Xinjiang is one of the world’s largest producers of cotton as well as polysilicon, which is used to manufacture solar panels.

These growing regulatory dynamics are creating a new urgency to comply with the UFLPA and the many other anti-supply chain washing laws being passed around the world. In their enforcement strategy, CBP specifically cites supply chain washing as a concern, stating that “manufacturing processes and multi-tiered supply chains can further obscure the use of forced labor inputs by incorporating them into legitimate manufacturing processes… Such goods could then be exported from a third country to the United States as a means of obscuring or “laundering” the importation of tainted raw materials from Xinjiang.”

The shifts require organizations take a multi-pronged approach to reduce related supply chain risk.

UFLPA Forces Extra Due Diligence and Required Documentation

1. To comply with the law and overcome the rebuttable presumption, importers with exposure to Xinjiang need to implement a heightened due diligence process for supply chain tracing. The UFLPA requires a significant, risk-based supply chain diligence program, including a written code of conduct, an ongoing monitoring and compliance program and plans on how to remediate violations. The evidence required to demonstrate supply-chain tracing is extremely detailed and requires very extensive mapping and documentation.
2. A substantial portion of CBP’s guidance focuses on prioritizing “cutting-edge technologies to identify and trace goods made with forced labor, specifically those technologies that support enhanced visibility into trade networks and supply chains that source goods or materials made with forced labor.”
3. The Forced Labor Enforcement Task Force (FLETF) has issued detailed guidance on “due diligence, effective supply chain tracing, and supply chain management measures” aimed at avoiding the importation of goods produced with forced labor in Xinjiang. CBP points to the Department of Labor’s Comply Chain as a template for a compliant due diligence program.
4. Supply chain leaders should only expect the need for compliance to rise with future guidance, as CBP makes clear in their release of intent to gather “foreign corporate registry data to map the structure of multinational companies and their global corporate networks.”

Anti-Supply Chain Washing Laws are On the Rise Globally

The UFLPA is far from the only sign that global regulators are cracking down on supply chain washing.

The US Securities and Exchange Commission has proposed rules to dramatically increase ESG disclosure requirements, and is taking a much stricter approach towards enforcement, probing large investment firms’ so-called sustainability funds. 

Take the example of S&P: In late March S&P settled allegations that it violated U.S. sanctions on Russia when it continued to extend credit to Rosneft, the country’s leading oil and gas company. Or examine recent incidents where components sourced in the UK and Germany were found in Russian warfare machinery being used against the people of Ukraine.

It’s simply not enough to know just who is in your supply chain and what they are doing. You also need to know about where your own products end up.

Supply Chain Washing Can Occur Anywhere

Xinjiang is far from the only area of the world generating concern over supply chain washing: On June 29, the Financial Times published a story highlighting evidence that strongly suggests that Russia may be using concealed/intentionally mislabeled shipments to export stolen grain from Ukraine through already-sanctioned ports in Crimea. Authorities admit confirming whether or not these shipments contain looted grain is difficult, and that ships containing sanctioned goods will often directly transfer cargo to other vessels once at-sea to avoid detection.

Despite these difficulties, accepting shipments of potentially sanctioned goods creates massive risk for large companies. In an interview with the Financial Times, Aline Doussin, a partner at Hogan Lovells, stated that even companies in locations that have not directly placed sanctions on Russia “might find that large multinational companies from those places stop trading with them over concerns that they were indirectly trading with sanctioned entities.”

German Law Shows Trend in Supply Chain Accountability 

Germany’s Supply Chain Law takes effect January 1, 2023. That law requires any company doing business in Germany to vet both their direct (Tier 1) and indirect (Tier 2) suppliers for compliance with core human rights and environmental protection measures – or face fines of up to 2% of their global revenue.

In analyzing companies subject to the German law, Interos found approximately 53% have problematic ESG scores using a proprietary scoring method that dynamically assesses an organization’s risk.

Although other European Union member countries are not yet in agreement on the terms of such legislation, it is likely the E.U. will follow with similar anti-supply chain washing laws in the near future.

ESG Supply Chain-related Disruptions Remain Expensive

The Interos 2022 Annual Global Supply Chain Report revealed that ESG-related issues currently cost companies, on average, $35 million per year – and those costs will rise as more anti-supply chain washing laws are enacted.

But many aspects of global supply chains are complex and opaque: most organizations only have visibility of their first- and second-tier suppliers.

Almost one-third (30%) of respondents to Interos’ annual survey said they would only know about an ESG violation in their supply chain if it occurred at their first tier of suppliers – not beyond.

Awareness of ESG issues in a company’s supply chain is no longer optional. Ignorance is not only costly financially and reputationally, but it can also put a company out of compliance with governmental regulations.

The Uyghur Forced Labor Prevention Act is just the beginning

The UFLPA is just one piece of a growing body of global legislation aimed at cracking down on unsound business practices, and the supply chain washing measures used to conceal them.

With new regulations being implemented every day, the already-high cost of noncompliance and poor supply chain visibility is only going to rise – but most organizations still report limited visibility of their suppliers, and a majority have ESG scores indicating noncompliance with some emerging laws.

Organizations will need to invest in capabilities and tools that give them continuous visibility over their direct and indirect suppliers and buyers. CBP’s guidance specifically states that the organization will invest in “enhanced supply-chain tracing technology that can connect imported goods to Xinjiang and other parts of the world at high-risk for forced labor. CBP also plans to invest in advanced search engines that may allow CBP to link known or suspected forced labor violators with their related business structures and transactions.”

As mentioned, Interos is adding the 20 entities named in Monday’s guidance to our automatically monitored entity list. We will continue to update our platform to assist with UFLPA compliance.

When it comes to sustainability and supply chain washing, the tide is clearly turning. Businesses that invest in powerful technology solutions and build robust compliance programs will be able to embrace this change with open arms. Those that ignore this wave of change, do so at their peril.

How Interos Can Help

The video below shows how Interos customers can quickly check their exposure to Xinjiang and the companies sanctioned in the UFLPA with just a few clicks – and how to setup continuous monitoring groups to receive alerts should their risk exposure change.

By Stuart Phillips & Geraint John

The U.S. Cybersecurity & Infrastructure Security Agency (CISA) has urged government and commercial organizations to patch vulnerable software and IT systems more rapidly in response to a flurry of malicious attacks against the cyber supply chain.

Last week, CISA issued an emergency directive requiring all federal civilian agencies using VMware’s Workspace ONE Access and other products to either patch or disconnect these systems by 5 p.m. ET this past Monday.

Separately, CISA also warned that hackers were actively targeting unpatched versions of F5 Network’s BIG-IP systems used to manage network traffic.

These new alerts join several others issued in recent weeks regarding cyber supply chain risks.

Earlier this month, CISA and other national cybersecurity agencies warned that managed service providers and their customers were at a heightened risk of attack. In late February, CISA issued a wide-ranging “Shields Up” advisory in the wake of Russia’s invasion of Ukraine, warning that malicious cyber activity was likely to increase.

VMware and F5 upstream supply chain attack vulnerabilities exposed

Commenting on one of these vulnerabilities, CVE 2022-22954, cybersecurity firm Mandiant said: “An attacker could exploit this vulnerability to perform a server-side template injection… An attacker would need to send a specially crafted request to the vulnerable system. A failed attempt at exploitation could potentially cause a crash of the application, resulting in a denial-of-service condition.” 

On April 13, VMware confirmed the exploitation of this vulnerability in the wild. On April 25, The Hacker News reported that a threat actor known as “Rocket Kitten” actively exploited this vulnerability to deploy the Core Impact penetration testing tool on vulnerable systems. 

Mandiant Threat Intelligence wrote that they consider this “a high-risk exposure due to the potential for arbitrary code execution with no user interaction required.”

VMware issued patches for this and other vulnerabilities in April and released additional fixes last week. CISA’s emergency directive suggests that many organizations have not quickly updated their systems.

And it’s not just government agencies that are at risk from these supply chain risks. 

“We also strongly urge every organization – large and small – to follow the federal government’s lead and take similar steps to safeguard their networks,” CISA said late last week.

CISA supply chain warnings reflects vulnerabilities deep in the cyber supply chain

There are many reasons why organizations fail to update their software and hardware fast enough, but budget and staffing shortages are primary.

Proactive Chief Information Security Officers (CISOs) can quickly discover if they have an installed vendor with security issues and schedule patches or updates to mitigate the problems. 

The real challenge is knowing whether their cyber supply chains have critical suppliers or partners using compromised systems and then taking steps to address those vulnerabilities. 

An analysis of Interos’ global relationship mapping platform data reveals the scale of the challenge: 

• 1,239 companies were identified using VMware’s Workspace ONE Access or F5’s BIG-IP products.
• 88 of these companies use both vendors.
• Of the top five direct buyers, more than half (58%) were U.S.-based and more than one-quarter (29%) were in the IT software and services sector.
• The U.K., Canada, Australia, and India are also home to major direct buyers, with banks, consumer services firms, and healthcare providers.

Looking further upstream into the extended cyber supply chain:

• The 1,239 companies using the affected VMware and F5 products directly supply more than 98,000 customers in the U.S., U.K, Germany, Canada, and other countries.
• These 98,000-plus firms, in turn, do business with more than 600,000 firms at Tier 2. 

Mandiant’s 2022 M-Trends report, published last month, found that supply chain intrusions were the second most prevalent form of attack in 2021.

Almost one-fifth (17%) of intrusions involved a supply chain compromise – up from just 1% in 2020. The vast majority of these attacks were related to the SolarWinds breach. 

Last week, cybersecurity firm SentinelOne published an analysis of a new supply chain malware attack against the Rust development community.

CISOs must monitor supply chain risks

Predicting the next supply chain cyber-attack or disruption is a dark art. However, being aware of all your suppliers and their connections may give you a better chance to understand weaknesses in your cyber supply chain and mitigate risks. 

Gone are the days when sending a survey to a supplier every two years and asking only about cyber risk was a practical approach. 

The best CISOs actively contribute to operational resilience by continuously monitoring their entire supply chains for multiple types of threats – including vendor financial weakness – using a risk mapping and scoring solution such as the one developed by Interos. 

To learn more about Interos, visit Interos.ai. 

By Geraint John and Margaret D’Annunzio

The ongoing litany of supply chain disruptions is prompting many organizations to redesign their global supply networks to build resilience. New research published this week by Interos found that almost two-thirds (64%) of executives said their organizations planned to make “wholesale changes” to their supply chain footprints.

And it’s not only business leaders that are focusing on the need for greater supply chain resilience.

Heavyweight economic and political institutions are also weighing in on the issue and proposing a variety of (sometimes conflicting) solutions – as evidenced by two recent reports from the International Monetary Fund (IMF) and the U.S. government.

The latter’s “Economic Report of the President,” (Economic Report) published in April, devotes an entire chapter to “building resilient supply chains.”

This portion of the Economic Report robustly analyses the evolution of modern supply chains and discusses some of the failures associated with firms’ and countries’ increased reliance on outsourcing and offshoring.

The Economic Report suggests that some of main reasons for supply chain globalization since the early 1990s are: Greater access to foreign suppliers through IT advances and lower trade barriers; government subsidies for key manufacturing sectors; and short-term financial incentives for top executives.

It argues that although COVID-19 exacerbated supply chain risks and made them more obvious, the pandemic did not create the majority of vulnerabilities, nor will its end abate them.

“Because of outsourcing, offshoring, and insufficient investment in resilience, many supply chains have become complex and fragile,” the report notes.

Shining a Light on Concentration Risk

Interos’ own research found that concentration risk is of particular concern to senior supply chain executives. Almost 9 out of 10 of the 1,500 procurement, IT and IT security professionals surveyed by Interos in the first quarter of 2022 agreed they had too many suppliers located in one area of the world.

Concentration is a Big Concern

“My organization has too many suppliers concentrated in one area of the world and this is of concern to us”

n=1,500; Source: Resilience 2022: The Interos Annual Global Supply Chain Report 

The White House report cites several examples of highly concentrated supply chains:

• Taiwan (and its dominant manufacturer Taiwan Semiconductor Mfg. Co. [TSMC]) produce 92% of the world’s supply of advanced semiconductors
• China manufactures 73% of lithium-ion batteries and has a 97% global market share of ingots and wafers used to make solar panels
• China also has a dominant position in the battery raw materials: lithium and cobalt, of which it refines 60% and 80% of global supply, respectively

Recent analysis of Interos’ global relationship mapping database found that while TSMC, as a contract manufacturer to the semiconductor industry, has a relatively small number of direct customers in the U.S. and Europe (Apple being the largest), its importance at tiers 2 and 3 is enormous.

And a new Interos report on rare-earth elements (REE) – which are also important inputs to computer chips and electric vehicles, among other products – noted that China controls 84% of the global market, with over 100,000 U.S. companies and more than 50,000 European firms having the top 21 Chinese REE suppliers in their extended supply chains.

Will Reshoring Really Bring Resilience?

One potential solution to fragile and concentrated global supply chains that gets plenty of airtime is reshoring production back to “home countries”.

Respondents to Interos’ annual survey said that, on average, they expected to reshore or nearshore around half (51%) of foreign supplier contracts in the next three years.

The White House’s Economic Report argues that “at least some domestic production of critical goods” such as semiconductors and batteries is required – in part for national security reasons.

However, the IMF, in its equally detailed analysis, takes a somewhat different view, noting that, on average, 82% of Western firms’ intermediate inputs are already sourced domestically. It argues that “policy proposals to reduce dependence on foreign suppliers, especially in strategic sectors… may be premature, if not misguided.” Instead, the IMF advocates greater diversification in international sourcing – that is to say, increasing the number of suppliers and locations used.

Interos’ survey findings appear to support this view, with more than 60% of executives saying their organizations plan to increase the number of firms in their supply chains over the next three years, compared with 15% or less that expect to reduce them.

Supplier Diversification is Happening

How the number of companies in organizations’ supply chains will change

n=1,500; Source: Resilience 2022: The Interos Annual Global Supply Chain Report 

 

Even if managers do successfully make the business case for bringing product manufacturing back onshore, they still face a number of challenges – not the least of which is developing a local supply base.

French sportswear brand Salomon is a case in point. It decided to make its running shoes in a highly automated plant in France after many years operating in Asia, but found it was still reliant on suppliers of soles and other parts in China and Vietnam.

Improving Supply Chain Visibility & Resilience

Despite their differences, the IMF and White House reports do agree on some things. Chief among these, perhaps not surprisingly, is the need for government policy to support companies in their resilience-building efforts.

Interventions include:

• Improving transportation infrastructure, such as major ports
• Reducing international trade costs, and in particular non-tariff barriers
• Convening and coordinating firms to develop standards and find industry-wide solutions
• Aggregating and disseminating data that help companies better understand their supply chains

On this latter point, both reports emphasize the importance of supply chain visibility.

“Visibility into supply chain relationships is necessary to identify vulnerabilities in supply chains, so that firms can properly plan for disruptive events,” notes the White House report.

Interos’ survey found overwhelming support among executives for technology to solve this problem.

Although less than a fifth said their organizations were already using intelligent, automated solutions to understand interdependencies at multiple tiers, three-quarters expected to have such technology in place within the next 12 months.

To download a copy of Resilience 2022: The Interos Annual Global Supply Chain Report, click here.