Supply Chain Cybersecurity: The Ukrainian War Increases Your Company’s Risk

Supply Chain Cybersecurity: The Ukrainian War Increases Your Company’s Risk

The war in Ukraine has brought the issue of cybersecurity into the mainstream of public opinion, with increasing media coverage of actual and potential Russian cyberattacks on businesses and infrastructure—often, far from the fighting.

These threats are very real, but for many companies they are not entirely new. Supply chain cyberattack risks, in particular, have been growing for some time, especially for companies in life sciences and other industries with sophisticated supply chains. And they can come from states like Russia, or from criminals.

A sampling of recent articles sheds light on the threats. The digital technologies that have made supply chains more efficient and responsive also make them vulnerable to bad actors. “The level of automation in the pharmaceutical industry makes it a prime environment for attacks. These environments are complex, and they haven’t been built to defend against nation-state attacks,” one security expert recently told the Biospace news site. The growing connection of operational technology to the network is also a factor, because it means bad actors can not only steal or damage data, they can also disrupt production and operations.

The variety of partners typically involved also makes the supply chain an attractive target. That’s because it increases the number of potential entry points, and it also means that a single attack can quickly move through the network to affect numerous partners.

Recent events have made this even more of a problem, as COVID and Ukraine have disrupted supply chains and forced companies to quickly turn to new, and often unknown, suppliers. As one security expert recently told Supply Chain magazine, this is a problem for medical devices manufacturers, “because on-time production and delivery can be a question of life or death. Supply chain is already the weakest link in any organization, even at the best of times. But for complex medical devices, where there is a multi-layered supply chain of hardware and software? For them, changing suppliers, or adding to them, significantly increases the exposure to risk.”

In short, cybersecurity will be a key supply chain concern for years to come. As a recent Forbes article noted, “Cybercriminals will continue to capitalize on the world’s heavy reliance on supply chains, infiltrating entire chains and not just individual companies…. More than ever, cybersecurity vulnerabilities are showcasing how interconnected we all are—as well as the fragility of many of these connections.” As a result, the article explained, supply chain cybersecurity should be a board-level issue.

Staying on top of the threat will require a multipronged defense.

Companies need to continue to harden their information and operational technology landscapes, through everything from zero trust security and education to combat social engineering, to security assessments, improved vetting of suppliers, and the comprehensive inventory of supply-chain assets. At the same time, they should prepare for the real likelihood that there may be a cyberattack on their supply chain and build the resilience to get back up and running quickly in the event of a problem.

Accepting the Realities of Supply Chain Disruption: Three Important Steps

Supply Chain Disruption

The likelihood of significant “black swan” events that drive supply chain disruption is expected to grow as the global economy becomes more interconnected. Global warming, changing weather patterns, geopolitical tensions, trade wars and worker shortages are increasingly common threats.

COVID served as a wake-up call for many companies, exposing shortcomings in their ability to identify and prepare for supply chain disruption. Those companies that do nothing to address these growing threats by strengthening their risk management practices are rolling the dice, and will likely continue to pay the price for inaction.

The first step in gaining greater control over supply chain management is to accept the realities of supply chain disruption. Gone are the days when an efficient Just-in-Time supply chain strategy could run smoothly on its own with little attention. Effective supply chain risk management now requires a total reexamination of current policies and procedures. A prudent course of action as we head into 2022 is for companies to follow these three steps:

Step One: Establish Risk Management as a Priority

Risk management must be an integral part of daily supply chain operations. The first step toward that goal involves establishment of an internal system of risk identification across the entire supply chain. Once those risks are identified, they must be analyzed, rank-ordered and prioritized based on the likelihood and extent of potential disruption they could cause.

This analysis provides an actionable data set and framework for your company’s risk management plan. As existing risks evolve, and as new risks arise, and all risks will require reprioritization, at least quarterly. Today’s supply chain managers must have this conversation with their company’s senior management team, to secure appropriate investment to support ongoing risk analyses.

Step Two: Formalize a Risk Scoring ProcessDynamic Supply Chain Risk Scoring

If some type of risk scoring does not already exist, that industry best practice is a necessity. One effective way to adopt that best practice is application of Dynamic’s Supply Chain Risk Scoring,SM a proprietary methodology that evaluates the key factors that can affect product availability, and provides a clear assessment of the strength and resiliency of the related supply chain. Dynamic’s Risk Scoring process evaluates and scores risks based on multiple risk categories and offers related mitigation solutions.

Step Three: Share Risk Management with Supply Partners

A third decisive step in evolution of your company’s risk management capability is the establishment of transparent relationships with suppliers, which involves proactive sharing of risk-related information and ongoing communication regarding actual and potential risks. This transparency-based partnership must include sources, availability and lifecycles of all products and components.

One of the best ways to set the expectation with suppliers for transparent communication is to include risk data sharing requirements in quote requests or service agreements. Managing the risks in supply chain in partnership with suppliers, where suppliers do not fear sharing negative information, is one of the most effective ways to navigate through the unpredictable and increasingly common threats of our global supply chain.

All companies would be well served to consider supply chain disruption as a “normal course” of doing business in the future. Making risk management a priority; building a risk identification and scoring process; and forging deeper relationships with suppliers are three effective ways to be prepared.

Pathways to Identify the Weak Links in Your Company’s Supply Chain

Identify Supply Chain Weakness

As material shortages, transportation delays, and longer lead times continue to disrupt supply chains around the world, it’s increasingly important that supply chain managers work to pro-actively identify, rank and mitigate potential risks.

Risks to product availability are always present, both at an industry-wide and company-specific levels. Global risks – including extreme weather, raw material shortages, transportation delays and geopolitical conflicts – are becoming more common, and require a more rigorous level of risk analysis and management. Company-specific risks within the day-to-day supply chain operation – including component obsolescence, stock outs, backorders and excess inventory – also require a higher level of scrutiny.

To gain a better understanding of their company’s current risk exposure, supply chain managers need to take necessary steps to ensure visibility into potential risks at the component level. Once those risks are identified, they must be rank-ordered and prioritized based on the likelihood and extent of potential disruption they could cause. This ranking gives supply chain managers clear insight into their top threats, as well as an understanding of the frequency with which each risk should be evaluated.

Using Risk Scoring to Identify Weak Links in Your Supply ChainDynamic Supply Chain Risk Scoring

If visibility at the component level is inadequate, or an internal risk identification and ranking discipline does not exist, adoption of an industry best practice may be a necessity. One effective way to initiate that process is application of Dynamic’s Supply Chain Risk Scoring,SM a proprietary methodology that evaluates the key factors that can affect product availability, and provides a clear assessment of the strength and resiliency of the related supply chain.

Dynamic’s risk scoring process evaluates and scores risks based on multiple risk categories and offers related mitigation solutions. Here’s a sampling of those risk categories that represent potential weak links in your supply chain:

Specification Flexibility

Validating only a single part number for a particular product can create sourcing constraints and cause disruption during technology lifecycle changes.

Concentration of Custom Products

Custom components can be a valuable solution for extending the life of a product, but entail the risk of availability constraints or unforeseen supplier events.

Multisourcing Capability

Ordering from a single supplier or from within a single geographical region increases the likelihood of adverse weather or transportation issues.

Component Lifecycle

An unexpected obsolescence of a product’s component can disrupt an entire platform. Lack of visibility to end-of-life dates or selecting components with a short lifecycle can increase risk.

Inventory Level Buffers and Safety Stock

Without an optimal level of safety stock on hand, the risk of supply stock outs is greater, and the ability to meet unexpected demand is reduced.

It’s important to understand that existing risks continuously evolve, new risks arise, and all risks require frequent reprioritization. In the current environment, transportation shortages may be the weakest link in the supply chain. In six months, it may be a weather-related, or due to labor issues at a major supplier. Scheduling regular checkpoints to reevaluate risk exposure is an important part of a company’s risk management plan.

Supply chain managers must continue to strive for increased visibility across their supply chain landscape. Leveraging the deep expertise of a solution provider such as Dynamic can greatly strengthen the identification, ranking and mitigation of supply chain risks. Contact Dynamic for a complimentary, self-diagnostic tool that can provide initial insight into your company’s risk exposure. And let us know if you would like to have an in-depth conversation regarding your company’s current supply chain priorities.

How to Make Supply Chain Resiliency a Priority

Supply Chain Resiliency

Resiliency is generally defined as the ability to recover from a threat or unanticipated change. As the term applies to supply chain management, resiliency is most often measured by the time that’s required to return to the prior level of operational efficiency after a disruption has occurred. Supply chain resiliency can also refer to the ongoing ability to avoid or mitigate a disruption. Most companies need to increase their ability to achieve both goals.

Building resiliency is always a challenge in supply chain management. For decades, companies have sought to reduce costs and become leaner in their supply chain management practices; but with the drive for greater efficiency comes risk. From increasing weather-related disruptions and natural disasters to rising geopolitical tensions, threats to the supply chain are increasing. Globalization of supply networks has also added a level of complexity and risk. These threats are costly and challenge a company’s ability to maintain and strengthen resilience.

Here are some ways your company can make supply chain resilience a priority:

Create a Proactive Plan

Supply chain risk management and resilience are directly related. The depth and relevance of your company’s risk management plan is a key indicator of how resilient its supply chain will be. Having thorough risk management practices puts your company in a more agile position to manage a disruption. Your plan should address risk at every layer of the supply chain, and be monitoring the plan frequently, to identify and assess potential vulnerabilities.

Adopt Digital Tools

Your company’s digital tool kit should not only collect relevant data; it most also identify key trends, as well as potential risks. For example, you will need to anticipate and plan for the potential for an environmental issue at a supplier’s location.

Expect the Unexpected

The pandemic has forced companies to refocus on the impact of unexpected events, both large and small. Labor shortages, demand fluctuations, shipping constraints and increased transportation costs have caused major disruptions in supply chains. Your company would be well-served to view unanticipated disruptions as a normal part of doing business, and plan accordingly.

Communicate with Partners

Before, during and after a disruption, collaboration and communication with suppliers is essential. Frequent communication and tight integration of systems with suppliers and partners in the supply chain should be an ongoing priority.

Be Prepared

Learn from the Boy Scouts. Safety stock and inventory buffers can reduce potential back-order constraints. Diversifying suppliers, or selecting and validating multiple components, adds redundancy and provides supply chain flexibility.

Documenting Disruptions

Compiling and evaluating data that demonstrates how risk management measures strengthened the supply chain during a disruption will help validate “lessons learned,” and foster a higher level of resiliency. Many companies maintain an internal supply chain management council that routinely evaluates data and risks.

Reducing the time that a threat disrupts your supply chain is a critical business objective. You can reduce the duration and severity of disruptions by following best practices like these, that are designed to increase supply chain resiliency.

Geography Matters When Selecting Critical Technology Components

Supply-Chain-Country-of-Origin

For many companies, one of the key lessons of the pandemic is that they must continue to reduce potential constraints and risk in their supply chain. A first step in that effort is to identify any components that are acquired from a single source or are custom-made. In terms of risk management, leveraging multiple suppliers and incorporating greater flexibility in component specification is akin to maintaining redundant data centers. Validation and purchasing of components from multiple suppliers can also substantially mitigate risk and add greater resiliency to the supply chain.

However, there are other risks associated with adding new suppliers. Notably, companies need to examine the country of origin of each component, as well as the inherent geographical risks associated with those countries.  Here are some specific geographical risk factors that must be considered:

Environment Risk

With the rise of global warming, weather-related events including tornados, floods, forest fires, and snowstorms are routinely causing shipping interruptions and delays. Switching to a supplier at another location can help companies navigate region-specific constraints. While storms and natural disasters are unpredictable, companies can assess the geographic area from which components are sourced and determine the potential risk levels of extreme weather or other events such as earthquakes. Depending on the severity of the disaster, major impacts to supply chain can be observed far beyond the local area, such as with the earthquake and tsunami in Japan in 2011. Companies should identify potential concerns and work with suppliers to understand their disaster preparedness plan.

Infrastructure Risk

In addition to environmental concerns, access to transportation and other infrastructure is a major geographical consideration. Nationally, regional storms and flooding can damage or close major highways, airports, railways, and ports, as well as impact the stability of telecommunications, electricity, and water. Components or necessary raw material sourced internationally increases risk. The current difficulties and increased lead times associated with maritime transportation, including container availability, port delays and congestion have been felt across the globe. Ideally, companies should identify potential shipping and logistics constraints and source components from multiple geographies to achieve greater flexibility.

Geopolitical Risk

Geopolitical factors represent another potential source of geographical risk. Tariffs are an important consideration for components sourced internationally, as they can add uncertainty and fluctuation in component costs. The possibility of other geopolitical tensions, that could give rise to trade or border restrictions, policy changes, and other regulations should be routinely evaluated. Economic and social instability based on political factors — ranging from labor strikes to terrorist threats and even war — can have a major impact on supply. Monitoring what is occurring in each country where components are sourced is essential.

As companies refine their supply chains for greater flexibility and resiliency, integrating additional suppliers from different geographical locations can substantially reduce risk. But knowing the risks associated with those additional geographical locations is an essential aspect of effective supply chain risk management.

Balancing Supply Chain Risks Against Costs: Four Reasons to Pay More for Components

Supply Chain Technology Components Availability Risks

Price has long been the primary consideration by manufacturers in their selection of suppliers of necessary components. Supply chain disruption in the wake of Covid-19, however, has caused many companies to re-examine every aspect of their purchasing process, including the true cost of a component, relative to its inherent risks.

When selecting a source for a low-value commoditized component, such as a cable, cost is typically the primary driver. That type of product is often widely available, and its suppliers don’t add incremental value. So why would a company pay more for something like a cable? One reason is supply chain risk.

With the increased supply chain complexity, failure to properly assess risk when sourcing a product can sometimes end up costing more than the anticipated savings in buying the cheapest product. Even a low value component such as a cable can become mission critical if, for a range of unforeseen reasons, availability or quality of the cable becomes an issue that affects production or client satisfaction.

So how should product / component risk be assessed and balanced against price? Consider these four factors.

PRODUCT IMPORTANCE

Determine how critical the component is to the finished good that’s being manufactured. Is the component core to its operation? Will not having this component cause costly shipping and sales delays? If those risks exist, then it’s important to buy from a dependable supplier, even if the price is higher.

PRODUCT SPECIFICATION

Examine the specification document to determine if the component can be easily swapped for an identical or similar component. If a particular OEM or part number is specified, there may be less flexibility in switching from one part to another. In that case, a higher price may be justified to ensure supply.

PRODUCT SOURCING

Identify where the product can be sourced. If it’s far from your location, there will likely be higher shipping costs as well as transportation risks. The greater the distance, the more likelihood there will be shipping disruptions, or trade and political issues. Again, a higher priced supplier closer to your location may prove to be less expensive in the long run.

SUPPLIER RELIABILITY

Evaluate the dependability of suppliers based on their past performance. Do they understand your business and the impact they have on its manufacturing capability? How strong are their relationships with component manufacturers, and will they advocate for you if there are constraints? Will they help you mitigate risk? Peace of mind based on these factors can justify paying higher prices for components.

The old expression “cheap is dear” rings true in the current supply chain environment. Manufacturers no longer can afford to assign cost as the primary factor in selection of product / component suppliers without examining all of the inherent supply chain risks.

Just-In-Time Inventory Management May No Longer Be Viable. What’s Your Strategy Now?

Just-in-Time Inventory Management

Lead times required for all types of products are now several times longer than pre-Covid. A product that took 4 weeks to procure might now take 20 weeks. Some products have no defined lead times. As supply chain disruption continues across all industries, OEMs are re-examining the viability of their longstanding system of Just-in-Time (JIT) inventory management.

Established as part of the lean manufacturing movement in the 1950s, JIT inventory management was adopted as a cost saving, capital conserving strategy. OEMs could minimize the overhead related to inventory storage, financing and management, freeing up the capital required to stockpile parts.

For JIT to be effective, however, OEMs needed to predict demand accurately, and order just enough supply to meet their near-term requirements. The inherent risk of JIT was that a part might not be delivered on time, and production could be stalled. When an OEM adopted JIT, they assumed that the cost of maintaining inventory outweighed the risk of a stock-out situation.

But COVID has changed the inherent balance in that risk / reward equation. The pandemic’s disruption of supply chains has greatly increased the risk to OEMs’ ability to manufacture their products. For the foreseeable future, JIT may be too costly and too risky as an inventory management strategy. So what should OEMs do?

Four Ways to Address the Loss of JIT Inventory Management

Regardless of industry, there are four ways that OEMs can address the loss of JIT inventory management:

Supply Chain Demand ForecastReassess the Demand Forecast

Manufacturers need to measure their demand forecast, both in terms of its accuracy, and how conservative it is. They should consider increasing the forecast, or pressing their sales organization to provide greater accuracy and transparency on customer demand.

Supply Chain Stock-out RiskCalculate the Cost of Stock-Outs

In the current economic climate, with demand spiking, the cost of losing sales, based on failure to deliver, could be very high. In addition to the immediate revenue loss, those companies may lose permanent market share as well as shareholder value.

Just-in-Time Inventory Cost ComparisonCompare Potential Revenue Loss with Inventory Holding Costs

Determine when this ratio begins to balance out. Is holding 4 weeks, 2 months or 6 months of inventory less expensive than the loss of sales? Think of the cost of holding inventory as the cost of an insurance policy. How much insurance coverage do you need, and how much will you pay for it?

Just-in-Time SuppliersReassess the Supply Base

Work with suppliers that will provide transparency into their supply chains, which will help to assess risk related to demand. Moving beyond a transactional relationship and building deeper engagement with suppliers enables companies to focus on sustainability and resiliency of their supply base. Always consider the strategic cost of sourcing a good at a higher price from a dependable supplier against the cost of the same good at a lower price from an unreliable source.

Over the past 70 years, JIT was a smart and efficient way for companies to manage inventories in a relatively safe and predictable world. Up until now, JIT has succeeded in keeping costs down. However, COVID has forced OEMs to reassess the current and long-term risks to their supply chains. As those risks continue to increase in an interconnected world, smart organizations will begin to invest greater focus and effort to ensure that risk mitigation strategies are applied as consistently and effectively as cost management.