What is Supply Chain Management?
Supply Chain Management (SCM) is the planning, control and improvement of all flows of goods, information and money between raw material suppliers, manufacturers, distributors and end customers, so that products and services reach the customer at the right cost, at the right time and in the right quantity. It covers procurement, production planning, logistics, inventory management, returns and collaboration with external parties. The term became widely known in 1982, when consultant Keith Oliver of Booz Allen Hamilton used it in an interview with the Financial Times.
In the OT context, SCM is not only a logistics discipline but also a critical link in cybersecurity, because suppliers often have deep access to systems, software and hardware.
🧠 What are the core functions of supply chain management?
- Procurement - selecting suppliers, concluding contracts and assessing supplier performance
- Planning - forecasting demand and aligning it with capacity, often in a monthly Sales & Operations Planning (S&OP) cycle
- Production - scheduling and executing orders on the shop floor
- Logistics - transport, storage, receipt and issue of materials and finished goods
- Inventory management - balancing stock levels between delivery reliability and tied-up capital
- Supplier relationship management - working together on the basis of trust, performance agreements and shared forecasts
- Traceability - tracking the origin, batch and status of parts and products, for example with tracking and tracing
- Reverse logistics - repair, take-back and recycling of products and packaging
The US professional body CSCMP summarises it as the planning and management of sourcing, procurement, conversion and logistics, plus coordination with channel partners such as suppliers, intermediaries, third-party logistics providers and customers.
🔄 How does the SCOR model describe the supply chain?
The best-known reference model for SCM is SCOR (Supply Chain Operations Reference), developed since 1996 by the Supply Chain Council and now maintained by ASCM. In 2022 ASCM released the SCOR Digital Standard (SCOR DS), a fundamental revision that replaces the linear process chain with a network of seven processes. SCOR DS is free to consult online with an ASCM account.
| Original SCOR | SCOR DS (2022) | What the process covers |
|---|---|---|
| Enable | Orchestrate | Strategy, business rules, network design, technology, data analytics, compliance and sustainability |
| Plan | Plan | Roadmaps, resource gaps and actions across all other processes |
| Deliver (part) | Order | Customer orders, pricing, payment methods and order status |
| Source | Source | Purchasing, ordering, receiving and transferring goods and services |
| Make | Transform | Production, assembly, disassembly and maintenance |
| Deliver (part) | Fulfill | Delivery scheduling, picking, packing, shipping, installation and invoicing |
| Return | Return | Reverse flows: diagnosing condition, assessing entitlement and disposal |
SCOR links every process to performance metrics and best practices. This lets companies benchmark their supply chain against other organisations, even when they use different software.
🏭 Where does SCM sit in the IT/OT architecture?
In a manufacturing company, SCM cuts across the levels of ISA-95 and the Purdue Model. Planning happens in office IT, execution on the shop floor:
| Level | Typical systems | Role in the supply chain | Time scale |
|---|---|---|---|
| Level 4 – business planning and logistics | ERP, MRP, APS, EDI with customers and suppliers | Demand planning, purchasing, orders, inventory valuation | Months to days |
| Level 3 – manufacturing operations | MES, WMS, quality systems | Detailed scheduling, material consumption, batch records, warehouse movements | Days to seconds |
| Levels 0–2 – control | PLC, SCADA, scanners and RFID readers | Execution, measurement, identification of products and load carriers | Seconds and faster |
A goods receipt shows how the levels work together: the supplier sends an electronic despatch advice via EDI, the driver delivers pallets with an SSCC label, the warehouse operator scans the barcode label and the WMS books the receipt, after which ERP updates stock and accounts payable. At product level, the GS1 GTIN provides unambiguous identification. With the GS1 standard EPCIS, whose version 2.0 was ratified in June 2022, supply chain partners share events in terms of what, when, where and why.
The more closely ERP and MES are connected, the more the supply chain benefits from current OT data. That is a core idea of Industry 4.0 and OT convergence. It also enlarges the attack surface: a link between a supplier portal and the MES is a potential route into production.
📈 What is the bullwhip effect and how do you measure supply chain performance?
The bullwhip effect is the phenomenon whereby orders fluctuate more and more strongly than actual customer demand the further you move up the supply chain. Jay Forrester described it in 1961 in Industrial Dynamics, and MIT developed the beer game to simulate it in the 1960s. In 1997 Lee, Padmanabhan and Whang identified four causes: demand signal processing, rationing and shortage gaming, order batching and price fluctuations. Shared inventory and sales data, smaller order quantities and stable pricing dampen the effect.
Supply chain performance is measured with a small set of indicators:
| Indicator | Definition | Why it matters |
|---|---|---|
| OTIF (On Time In Full) | Share of orders delivered both on time and complete | Direct measure of delivery reliability |
| Perfect order | Share of orders without any error in timing, quantity, documentation or quality | Stricter than OTIF and a key SCOR metric |
| Inventory turnover | Cost of goods sold divided by average inventory | Shows how much capital is tied up in stock |
| Cash-to-cash cycle | Days of inventory plus days sales outstanding minus days payable outstanding | Time between paying the supplier and being paid by the customer |
| Forecast accuracy | Deviation between forecast and actual demand, often as MAPE | Basis for inventory and capacity decisions |
LEAN and just-in-time reduce inventory and lead times, but make the supply chain more vulnerable to disruption. After the chip shortages of 2021 and 2022, many industrial companies therefore went back to holding buffer stock of critical components.
🔐 Why is the supply chain a cybersecurity risk?
Suppliers of OT systems deliver not only hardware but also firmware, software, updates and remote maintenance. An attacker can abuse each of those flows:
| Cyber risk | Example in OT |
|---|---|
| Compromised component | Malware in the firmware of a PLC from an external supplier |
| Uncontrolled remote access | A maintenance contractor has permanent VPN access to the SCADA environment |
| Shadow IT and unvalidated tools | Installation of unapproved software in the production environment |
| Software integrity | Tampering with update files distributed without code signing |
| Unknown dependencies | Vulnerable open-source library in a device without an SBOM |
Attacks such as SolarWinds (2020), NotPetya (2017) and 3CX (2023) came in through suppliers. NotPetya entered via an update of Ukrainian accounting software and took down Maersk’s IT; the APM Terminals container terminals on the Maasvlakte in Rotterdam were largely at a standstill for more than a week. Maersk estimated the damage at 200 to 300 million dollars. The example shows that a logistics chain also stops when only the IT for planning and orders fails. A full overview is given in supply chain risk.
✅ Which security measures belong to SCM?
Supply chain security combines contractual, organisational and technical measures:
| Measure | Description |
|---|---|
| Supplier Security policy | Include security requirements, notification duties and audit rights in contracts |
| Third Party Risk Management | Risk assessment and ongoing monitoring of external parties |
| Asset Inventory | Knowing which components, firmware versions and suppliers are in the installation |
| Secure Boot and firmware signing | Only allow signed firmware and software to boot or install |
| Access Control and Jump Server | Remote access via controlled, time-limited and logged routes |
| Patch management | Obtain updates via trusted channels, verify them and test them first |
| Monitoring and anomaly detection | Detect unusual activity on supplier connections |
⚖️ Which laws and standards affect supply chain security?
| Framework | Relevance to the supply chain |
|---|---|
| NIS2 Article 21 | Essential and important entities must manage the security of their supply chain, including relationships with direct suppliers |
| Dutch Cybersecurity Act (Cyberbeveiligingswet) and Cybersecurity Decree | Dutch implementation of NIS2, in force since 15 August 2026; Article 10 of the decree sets out the supply chain policy requirements |
| Cyber Resilience Act | Manufacturers must deliver secure products with security updates and draw up an SBOM; reporting obligations from 11 September 2026, full application from 11 December 2027 |
| IEC 62443-2-4 | Security requirements for integrators and maintenance service providers of industrial systems |
| ISO 27001:2022 | Annex A controls 5.19 to 5.23 for supplier relationships and the ICT supply chain |
| ISO 27036 | Separate series of standards with guidance on information security in supplier relationships |
| SOC 2 and ISAE 3402 | Assurance reports on the controls of service organisations; SOC 2 tests the Trust Services Criteria (always security, optionally availability, confidentiality and others), ISAE 3402 processes relevant to financial reporting |
The origin of suppliers also matters in critical infrastructure, see high-risk suppliers. In addition, the EU Ecodesign for Sustainable Products Regulation (EU) 2024/1781, in force since 18 July 2024, introduces the digital product passport, made mandatory product group by product group through delegated acts. The battery passport follows from 18 February 2027 under the Battery Regulation. Traceability data across the chain is thus increasingly becoming a legal requirement.
📦 What is the difference between the digital and the physical supply chain?
| Digital chain | Physical chain |
|---|---|
| Software suppliers, updates, cloud services | Components, equipment, spare parts |
| Remote access, e-maintenance | On-site installation, field engineers |
| IT/OT integrations and data platforms | Packaging, storage, just-in-time delivery |
In OT the two chains are tightly intertwined and must be managed and secured at the same time. After all, a replacement PLC from the physical chain also brings firmware from the digital chain.
🧭 How do you strengthen SCM step by step?
- Map the supply chain - record which suppliers, sub-suppliers, transport routes and systems affect each critical product, linked to your asset inventory.
- Determine criticality - which supplier or component could halt production or compromise safety if it fails? Record this in your business continuity plan.
- Make the information flow unambiguous - use GS1 identification, EDI and clear system boundaries between ERP, WMS and MES in line with ISA-95.
- Share data with supply chain partners - shared forecasts and stock positions dampen the bullwhip effect.
- Set security requirements - include IEC 62443-2-4, an SBOM and notification arrangements in your purchasing terms.
- Restrict and monitor access - allow suppliers in only via a jump server and logged remote access.
- Measure and review - track OTIF, inventory turnover and supplier incidents, and reassess critical suppliers at least once a year.
❓ Frequently asked questions
What is the difference between supply chain management and logistics?
Logistics is about physically moving and storing goods. Supply chain management is broader and also covers procurement, planning, production, returns and collaboration with supply chain partners. Logistics is therefore one part of supply chain management.
Which software is used for supply chain management?
The core is usually an ERP system for orders, purchasing and inventory, supplemented by a WMS for the warehouse, a TMS for transport and an MES for the shop floor. For complex planning, companies often use a separate APS package. Through EDI these systems exchange orders and despatch advices with customers and suppliers.
What is the SCOR model?
The SCOR model is a reference model for supply chain management that describes processes, performance metrics and best practices. The current version, the SCOR Digital Standard from 2022, has seven processes: Orchestrate, Plan, Order, Source, Transform, Fulfill and Return. ASCM maintains the model.
Why does supply chain management matter for OT security?
Suppliers deliver firmware, software and remote maintenance to OT systems and are often given extensive access to do so. A compromised supplier or update can therefore hit production directly, as NotPetya and SolarWinds showed. That is why security requirements and access control are part of professional supply chain management.
Does NIS2 require me to assess my suppliers?
Yes, if your organisation falls under NIS2, Article 21 requires measures for supply chain security, including relationships with direct suppliers. In the Netherlands this is implemented in the Cyberbeveiligingswet, which has applied since 15 August 2026. You must take into account, among other things, your suppliers’ vulnerabilities and development practices.
How does traceability help in the supply chain?
Traceability shows where a product or batch came from and where it went. With GS1 codes such as GTIN and SSCC and event data via EPCIS, you can quickly determine which parties are affected during a recall. The same data underpins the digital product passport that the EU Ecodesign regulation makes mandatory per product group.
📌 In summary
Supply Chain Management controls the flows of goods, information and money from supplier to customer, and in OT environments it is also a critical cybersecurity link.
SCM connects planning in ERP with execution in MES, WMS and shop-floor control. Reference models such as SCOR, GS1 identification and indicators such as OTIF make the supply chain manageable and measurable. Because suppliers deliver firmware, updates and remote access, supplier security, access control and traceability are inseparable from it, especially now that NIS2, the Dutch Cybersecurity Act and the Cyber Resilience Act set requirements for them.