SEMICONDUCTOR SUPPLY CHAIN AND CYBERSECURITY ASSESSMENT

In recent years, the semiconductor supply chain has increasingly become a target for both nation-state actors and cybercriminals. This trend is anticipated to persist, underscoring the need for companies in the semiconductor industry to defend against a broad spectrum of sophisticated threats. The semiconductor supply chain is highly intricate, with global distribution of materials, advanced manufacturing equipment, software tools, and other capabilities. Both design and manufacturing processes involve thousands of employees operating across a worldwide network, making even minor disruptions upstream potentially cause significant ripple effects downstream. This complexity presents unique challenges in modeling and addressing cybersecurity threats.

Currently, cybersecurity efforts are focused on enhancing enterprise-wide defenses and responding to existing threats. This leaves limited capacity for organizations to anticipate and map emerging cybersecurity risks against their operations systematically. Addressing these issues is critical for the economic and national security of the United States, as well as for maintaining technological leadership. The U.S. government is making unprecedented investments in semiconductors through the CHIPS Act and other policy initiatives. Simultaneously, foreign governments are also heavily investing in their own semiconductor industries and may be seeking to undermine international competitors through cyber operations. 

The 2023 National Cybersecurity Strategy highlights the importance of integrating substantial cybersecurity investments with semiconductor supply chain resilience to safeguard the U.S. digital ecosystem. Forecasting cybersecurity threats specific to the semiconductor industry is urgently needed to protect the significant investments made by private stakeholders and the U.S. government in strengthening U.S. leadership in this critical sector. The Fiscal Year 2024 National Defense Authorization Act (FY24 NDAA) prescribes entering into agreements for the purpose of assessing the feasibility and advisability of improving the cybersecurity of the semiconductor supply chain.