Supply Chain Risk Management

The tradecraft layer

Supply chain risk management (SCRM) has two layers. Software platforms screen suppliers at scale, flag anomalies, and automate workflow. Cleared analysts take an ambiguous ownership structure, an opaque intermediary, or a suspect IT component and produce a risk judgment a government customer can act on and defend.

Platforms surface anomalies. Cleared analysts render judgments.

Intel Analysis works in the second layer. The practice begins where automated screening stops returning useful answers, and it is staffed by analysts who came out of the intelligence community rather than out of a software company. The firm has worked in supply chain risk since 2016, before the current regulatory wave made it a category.

Supply chain risk is where the firm has most recently proven its tradecraft, not the limit of it. The same all-source discipline described on this page is applied wherever a mission needs cleared analytic judgment — this practice is the worked example.

Where automated screening runs out

Screening tools are good at the suppliers that document themselves. A tier 1 vendor is registered, audited, and verifiable, and so is the tier 2 vendor behind it. Risk concentrates further down, in the tiers a purchase order never names.

• Ownership that resolves to a jurisdiction or a nominee rather than to a person
• Component provenance that cannot be traced past the assembler
• Intermediaries whose records are clean because they are recent
• Corporate structures reorganized faster than public registries update
• Relationships that are visible in aggregate but not in any single record

Illuminating those tiers is analytic work. It means reconciling incomplete and contradictory records, judging which sources carry weight, and stating plainly how confident the judgment is and what would change it.

What we assess

• IT component risk and threat analysis
• Vendor and supplier risk across multiple supply tiers
• Corporate ownership structure and beneficial ownership
• Indicators of foreign ownership, control, or influence (FOCI)
• Analysis related to the Committee on Foreign Investment in the United States (CFIUS)
• Risk assessment and mitigation
• Supply and value chain management support

How the work is done

The method is all-source intelligence analysis. Analysts work the available reporting and open material together, weigh sources against each other, and carry the uncertainty forward into the judgment instead of resolving it silently. The finding says what is known, what is inferred, and what remains open.

The company is analyst-owned and analyst-led, so review happens between people who have done the work themselves. Its analysts are experienced in ICD 203 — the Intelligence Community’s analytic standards directive — and adhere to those and other standards when requested by customers.