Supply Chain Risk Management (SCRM) is the practice of finding, assessing, and reducing risks in the suppliers, products, and services an organization depends on. It looks at the full lifecycle of an asset, from procurement and installation to patching, maintenance, replacement parts, and decommissioning.
SCRM matters because many cyber attacks bypass direct perimeter defenses and instead target trusted vendors, updates, firmware, remote support channels, or third-party components. In critical infrastructure, a weak supplier can become a path into systems that are otherwise well defended. Defenders use SCRM to verify provenance, control updates, limit remote access, maintain inventories, and prepare for supplier failure or compromise. The goal is to reduce dependence on blind trust and make supply relationships more resilient.