Review - BIS Publishes Connected Vehicle Supply Chain Security ANPRM

Today, DOC’s Bureau of Industry and Security (BIS) published an advanced notice of proposed rulemaking (ANPRM) in the Federal Register (89 FR 15066-15072) on “Securing the Information and Communications Technology and Services Supply Chain: Connected Vehicles”. BIS is looking for public comments on the potential impacts of EO 13873, Securing the Information and Communications Technology and Services Supply Chain, on connected automotive vehicles.

Public Comments

The purpose of this ANPRM is to solicit a wide range of public input into the topics discussed above. Comments may be submitted via the Federal eRulemaking Portal (www.Regulations.gov; Docket # BIS–2024–0005). Comments should be submitted by April 30^th, 2024.

Commentary

While there is certainly some amount of justification at specifically looking at the vulnerabilities associated with devices and equipment manufactured by Chinese companies associated with ICTS, this should be viewed within the larger construct of vulnerabilities in ICTS in general. This is especially true since various Chinese government and governmentally influenced APT groups have shown a propensity and capability to compromise vulnerabilities in American and allied ICTS products. Targeting Chinese ICTS components cannot be viewed as a solution to the vulnerability of ICTS products, but only as a small part of the necessary efforts to secure those supply chains.

 

For more details about the provisions of this ANPRM, including a look at some of the questions for which BIS is seeking public comment, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/bis-publishes-connected-vehicle-supply - subscription required.