Intel Analysis
Engine cluster of 1st stage of a saturn i rocket engine located on north side of static test stand

HomeCapabilities

Supply Chain Risk Management Flagship practice

We investigate the suppliers, components and ownership relationships that can introduce risk into federal supply chains.

Discuss your requirement   How we can help

Engine cluster of 1st stage of a saturn i rocket engine located on north side of static test stand
Wikimedia Commons / HAER, LoC · public domain

Deliverables

What you receive

Depending on the assignment, our support includes:

  • Risk assessments

    A clear assessment of the risks associated with a vendor, component, company or supply tier and their implications for your organization.

  • Supporting analysis

    The evidence, reasoning and confidence behind the assessment, including gaps and information that could change the conclusion.

  • Mitigation options

    Practical options for addressing the risks, with the benefits and tradeoffs explained so you can decide how to proceed.

Every detail. A wider context.

Understanding a supply chain means looking beyond the finished product. We examine organizations, components and the relationships between them.

HAER DC-56 buoy-crane drawing over container cranes, Tokyo Bay

HAER DC-56 buoy-crane drawing over container cranes, Tokyo Bay · public domain

Earth Observations taken by the Expedition 13 crew

Ownership · Components · Relationships

Earth Observations taken by the Expedition 13 crew — open-pit mine photographed from the International Space Station.

Earth Observations taken by the Expedition 13 crew
NASA Image and Video Library · public domain

Context

What drives the requirement

The following regulations and federal guidance inform supply chain risk requirements. These are general summaries.

Regulatory drivers

Regulations and federal guidance driving supply chain risk requirements
NIST SP 800-161Cybersecurity supply chain risk management practices for systems and organizations. The reference framework federal C-SCRM programs are built against.
NIST SP 800-171Protection of controlled unclassified information in nonfederal systems. The control set defense suppliers are measured against.
DFARS 252.204-7012Safeguarding covered defense information and cyber incident reporting. Obligates defense contractors to implement NIST SP 800-171 and to report incidents.
CMMCThe Department of Defense program for assessing contractor cybersecurity, with requirements that flow down through subcontract tiers to suppliers who rarely deal with the government directly.
Section 889The FY2019 NDAA prohibition on procuring or using certain covered telecommunications and video surveillance equipment and services, which requires a supplier to know what is inside what it sells.
DoD SCRM Integration CenterA Department of Defense focal point for supply chain risk analysis supporting acquisition decisions.

Evidence

Our experience

The experience and credentials behind our work.

Analyst-owned and analyst-led
Founded in 2006 by career intelligence analysts. President Carl McDonald has worked in intelligence since 1984, served as a US Navy intelligence analyst and holds PMP and ISSO certifications.
Supply chain expertise since 2016
The president has been a supply chain risk management subject matter expert since March 2016. This experience provides continuity and depth in supplier risk assessment.
Supporting federal customers since 2006
Continuous all-source analytic support to the Department of Defense, the Department of Homeland Security, national-level agencies, combatant commands, and federal, state, and local law enforcement.
Recognized analytic work
Employees have received individual and team Director of National Intelligence awards.
Experienced in analytic standards
Analysts are experienced in ICD 203 and adhere to those and other standards when requested by customers.
Contracting eligibility
SBA-certified Service-Disabled Veteran-Owned Small Business — eligible for sole-source and set-aside award under FAR Subpart 19.14. UEI LK5CFHLMKLK1, CAGE 4CDF0.

Procurement

How to work with us

IAI is an SBA-certified Service-Disabled Veteran-Owned Small Business (SDVOSB), eligible for sole-source and set-aside awards under FAR Subpart 19.14. We also work with prime contractors through subcontracting arrangements.

Find our business identifiers, industry codes, verification sources and contracting information on our contracting page.

Next step

Discuss your requirements

Last reviewed 26 August 2026.