As part of global innovation, digital products and systems are increasingly incorporating proprietary and open-source third-party components that offer numerous benefits such as improved functionality and reduced costs. At the same time, relying on third parties introduces new risks due to the dependencies and the loss of control. Therefore supply chain security has become a substantial challenge for the entire ecosystem, but more importantly to critical infrastructure since its reliability is of key importance to society.

Different aspects such as risk management, vulnerability management, compliance complexity or incident response are entailed in supply chain security, but the remaining question is still: how to correctly handle these? Different stakeholders are involved in the effort of protecting critical infrastructure, but roles and responsibilities are oftentimes not clearly defined.

As an example, in the healthcare industry medical device manufacturers must deliver secure products with the highest possible quality standard to healthcare providers. Therefore, medical device manufacturers need to select third party components which meet their quality level and hold the third party providers accountable to maintain the level of security. Furthermore, medical device manufacturers must maintain the security of their medical devices during the entire product lifetime. This task is not entirely the medical device manufacturer’s responsibility, since the operation of medical devices is in an uncontrollable environment, e.g. in the healthcare provider premises. Accordingly, healthcare providers are also part of ensuring the operational security of their medical devices and ecosystem.

Various stakeholders from the public and private sectors have their role and responsibility to deal with supply chain security challenges. It is of great importance to allow for an open conversation about the problem so that all stakeholders can jointly work on building trust and competence.

Questions and points to be covered during the session