The security of supply chains for information and communication technology (ICT) is a key prerequisite for the functioning of digital services and, consequently, for the state, the economy, and society. In particular, public and private entities providing essential and important services within the meaning of the NIS-2 Directive depend on trustworthy, transparent, and resilient ICT supply chains to ensure that their services remain protected against cyberattacks, manipulation, and disruptions over the long term.
Against this background, the CLEAR-CHAIN project aims to make a well-founded contribution to the development of a national concept for cybersecurity in the supply chain of ICT products and ICT services, pursuant to Article 4(2)(a) of the NIS-2 Directive, as part of the national cybersecurity strategy. The study addresses the need to systematically identify and assess security-relevant risks in increasingly complex, often internationally interconnected ICT supply chains and to apply these findings to the Austrian context, thereby enabling the derivation of concrete implementation requirements and actionable guidelines.
The aim of the study is to systematically identify, assess, and prioritize threat scenarios, typical attack vectors, vulnerabilities, critical dependencies, and protection requirements across the ICT supply chain. It examines how technical, organizational, regulatory, and geopolitical factors contribute to the emergence of risks and how these affect the resilience and operational capabilities of entities. Particular attention is paid to dependencies on specific providers, technologies, or countries of origin, as well as to risks arising from compromised or manipulated products and services.
Building on a systematic analysis of existing regulatory, normative, and technical measures, as well as internationally recognized frameworks and models of good practice, the study evaluates their effectiveness and practical feasibility and identifies existing implementation challenges. In addition, transparency, proof of origin, and traceability throughout the supply chain are analyzed from technical, organizational, and regulatory perspectives. Empirical findings from expert interviews, surveys, and structured stakeholder consultation formats are incorporated into the assessment, enabling a practical evaluation of the issues concerned.
The project results include a nationally tailored threat and risk catalogue for ICT supply chains, models for the systematic identification and assessment of risks, and legally sound, implementation-oriented recommendations for action. Furthermore, approaches are developed to improve cooperation and information sharing between entities, suppliers, and service providers, as well as to strengthen the cybersecurity culture throughout the supply chain (e.g., through training, audits, certifications, and contractual requirements). CLEAR-CHAIN thus establishes a robust evidence base for policy-making processes and supports the strengthening of national cybersecurity.
Project lead: AIT Austrian Institute of Technology GmbH