Supply Chain Risk

NIST’s National Vulnerability Database guide explains how contractors can use vulnerability data in security assessments and software bill of materials workflows, while accounting for enrichment delays and API rate limits. It recommends checking CISA’s Known Exploited Vulnerabilities catalog to help prioritize remediation and is practical guidance—not a new procurement or compliance requirement.

Connecticut, New Jersey, New York, and Michigan reached a settlement with Perry Johnson Companies after a 2023 breach exposed records belonging to more than 13 million people. The company must pay $300,000 and implement specified security reforms, with a potential additional $9.7 million payment for failure to comply—a procurement risk signal for contractors handling health data.

ILC Dover LP and ILC Astrospace LLC agreed to pay $13 million to resolve False Claims Act allegations that they misrepresented compliance with cybersecurity requirements on federal contracts involving the Army, Missile Defense Agency, and NASA. The settlement highlights potential contractor liability for deficient security controls, cloud safeguards, security plans, and DoD assessment reporting; it does not create a new procurement opportunity.

China’s electric-vehicle cost and production scale reflects more than manufacturing efficiency: the source highlights long-running industrial policy, directed subsidies, local-government support, and domestic-market backing. For government buyers and contractors, this is market intelligence—not a new procurement action—relevant to sourcing assumptions, tariff exposure, and connected-vehicle data risks.

A joint CIS, MS-ISAC and CoSN report finds frequent cyber incidents across K-12 systems, with limited staffing and budget constraints delaying defensive work. The findings point to potential demand for shared security services and targeted support, but announce no solicitation, award or dedicated funding source.

A Department of Homeland Security order issued July 24, 2026, excludes DeepSeek and covered affiliates from federal civilian procurements and requires removal of covered products, including certain third-party offerings built using DeepSeek implementations. Contractors should assess component origins across their supply chains, flow down required clauses, and meet reporting deadlines; the agency exception-request window closed September 22.

Seventeen bipartisan former national security officials asked the D.C. Circuit to rehear Anthropic’s challenge to the Pentagon’s supply-chain-risk designation. The case could influence how the Defense Department applies supplier restrictions and how agencies and contractors evaluate Anthropic’s Claude models, but the filing is not a new procurement action.

CISA, the FBI, the U.S. Secret Service, and international partners report that SafePay has affected about 600 organizations worldwide since August 2024, including critical-infrastructure operators. Contractors should review the advisory’s indicators and mitigations, urgently patch cited Cisco, Veeam, and SonicWall vulnerabilities, and assess protections for remote access, networks, and backups.

On October 13, 2026, a security incident involving a compromised ConnectWise account allowed unauthorized access to 173 Microsoft 365 tenants. This breach emphasizes the critical need for enhanced security measures in the managed service provider environment, especially for government contractors relying on such services.

The UK government has seen a 20% rise in Cyber Essentials certifications, totaling 61,430 from July 2025 to June 2026. However, many certifications are recertifications, indicating limited new adoption among SMEs. As procurement requirements evolve, expect heightened demand for Cyber Essentials compliance from suppliers, especially within the small and medium enterprise sector.

The U.S. International Trade Commission has begun an investigation into certain mobile devices after GG Technologies filed a complaint against Apple. This may lead to import restrictions, affecting supply chains and compliance for vendors involved in mobile hardware and software.

The WhiteCobra malware, targeting Visual Studio Code users, poses significant cybersecurity risks to government agencies and contractors. Vulnerabilities in commonly used software development tools necessitate enhanced risk management and security assessments to safeguard sensitive data.

A security vulnerability involving **Unisoc**, **Longcheer**, and **Motorola** threatens millions of budget Android devices in Latin America. Procurement professionals need to reevaluate their supply chain security protocols to mitigate risks related to this significant compromise.

The recent compromise of the popular open-source package @asyncapi/specs through a malicious commit highlights critical vulnerabilities in software supply chains. Government agencies and contractors must urgently reassess their security strategies and adopt stringent measures to protect against similar supply chain attacks.

The U.S. International Trade Commission is investigating patent infringement in energy drink labeling following a complaint from Monster Energy Company. This may lead to significant trade implications for suppliers and manufacturers involved in these products.