The Convergence of Cyber-GRC and Physical Logistics

Supply chain assurance often rests on a simple assumption: if the cyber dashboard is green and the logistics dashboard is green, the enterprise is safe. In August 2026 BAE Systems, Inc. settled with the United States Department of State for $36 million over 104 charged violations of export control law (United States Department of State, 2026). The charging letter describes a company whose functions could each have reported themselves compliant. I recognise that gap from eighteen years spent on one side of it.

The settlement covers violations of the Arms Export Control Act and the International Traffic in Arms Regulations between 19 May 2019 and 24 March 2025. Half the penalty, $18 million, was suspended against remedial compliance measures. The company had also reported the violations itself, through more than twenty voluntary disclosures. The detail that matters is how the charging letter accounts for 104 violations arising between a supply chain team, an IT system and a workforce.

The letter deals first with a single episode, on 13 and 14 December 2023. Technical data related to printed wiring boards for GPS receivers reached a manufacturer in the People's Republic of China, a destination proscribed under 22 C.F.R. 126.1. Because each transmitted document was charged separately, that one episode accounts for 38 of the 104 violations. The letter records four conditions behind it. The supply chain team did not fully understand the applicable export control regulations. The secure file transfer network did not adequately flag export control warnings before transmission. No formal training or written process governed use of that network, and there was no adequate understanding of who export control questions should be put to. Similar gaps form in ordinary supply chains, and they may widen once custody moves to systems.

Two green dashboards

From a stores account, the four conditions describe one failure from four directions. The people handling the material did not hold the regulatory knowledge. The system moving the data did not carry the warning. No written process governed the system, and nobody knew who to ask. Each function could have reported itself compliant within its own scope, and each would have been telling the truth as it understood it. The United States Government nonetheless assessed that certain of the unauthorised exports created the potential for harm to national security.

Survey research with 388 supply chain managers at United States manufacturers has tested how cyber risk management strategies relate to cybersecurity integration inside the firm and with suppliers and customers (Jazairy et al., 2024). Cybersecurity and governance teams tend to work on ISO/IEC 27001 scopes, vendor assessments and access control. Trade compliance and logistics teams work on customs declarations, controlled goods, freight contracts and inventory records. The board receives a separate update from each, and both can be green while the enterprise remains exposed to loss, disruption and enforcement. In my view, risk moves along the chain of custody in a way neither function is placed to see as a whole.

The blind spot

A review of the research on managing cyber risk in supply chains set an agenda for further work (Ghadge et al., 2020). Published practice now covers cybersecurity supply chain risk management for systems and organisations (National Institute of Standards and Technology, 2022). Both treat a supplier's cyber exposure as a supply chain risk, and the consequences can cross from software into transport. A ransomware attack on a tier-two component supplier might leave the buyer's own systems untouched and still stop manufacturing. At that point the cyber incident has become a readiness problem. Run the other way, an inventory ledger may record five hundred critical replacement units in stock while handovers and incomplete records have produced unrecorded damage and scrap, with nobody falsifying anything.

The National Cyber Security Centre's guidance on mapping a supply chain asks organisations to record sub-tier relationships alongside the assurance evidence held for each supplier, which points to the same gap in supplier assurance. A supplier may submit a completed questionnaire and hold valid certifications. An adversarial review of its sub-tier dependencies, filings and ownership signals may then surface concentration risk and indicators of export control exposure that the vendor portal was never designed to look for. In all three cases each function reported accurately on what it was built to see, and the risk stayed where nobody was watching.

The picking error

The charging letter contains a second episode that anyone who has run a stores account may recognise. In September 2020 an export compliance officer approved the export of an F404 ECU, an item subject to the Export Administration Regulations, to Switzerland. The shipping department then picked a T700 Full Authority Digital Engine Control from the export hold shelf. That item is controlled under USML Category XIX(e) and designated Significant Military Equipment. Dock personnel packed it without verifying its part number against the shipping memorandum. It left under the wrong regulation, cited on the commercial invoice under an Export Control Classification Number instead of its Munitions List category. The compliance decision was correct and made no difference. The control that should have enforced it was a person checking a part number against a document.

The Export Control Joint Unit's compliance code of practice asks for documented procedures, a named responsible person at director level, training matched to its audience and an adequate audit trail (Export Control Joint Unit, 2022). Much of the evidence needed to satisfy it is likely to be created by logistics, procurement and engineering staff who do not think of themselves as operating controls. The picking error shows that an export control violation can follow from an ordinary stores verification step. The people who perform that step may never be told that they work inside a regulatory control environment.

Careful with the word "unified"

What this essay calls unified supply chain governance is my own shorthand and not an established category. It means treating physical custody, trade compliance and digital security as connected parts of one control environment. The word needs care, because some separations are controls. Export control judgement is often held apart from commercial pressure so that a shipment deadline cannot lean on a classification decision. The argument here is for visibility across the interfaces, since a single merged dashboard under one owner would be a larger version of the same problem.

When there is nothing to muster

ISO/IEC 27001 builds logging, access review and control testing into information security management. Physical logistics would need the equivalent: rolling physical verification that tests the ledger against what is there. Rolling verification carries two assumptions: that there is an item to examine, and that a competent person is able to go and examine it.

An international standard now sets out how an organisation should manage its AI systems (ISO/IEC 42001, 2023). The accountability regimes that govern physical materiel still assume a named custodian who can be asked what became of an item. Automated warehousing, uncrewed vehicles and autonomous systems are removing that custodian. Four conditions follow, and conventional accountability cannot record any of them. Self-relocating property moves under pre-authorised instructions with no human decision at that moment, so a loss investigation has no custodian to question. Evidence without witnesses leaves machine telemetry as the only record that an asset was destroyed when it may have been stolen or diverted. That data may be assured for operational use but never for audit. Adversarial possession puts a spoofed or diverted asset in someone else's custody, often with no ledger entry or reporting route for the payload it carried. Migration of value moves the expensive, controlled item between cheap, expendable platforms, so a write-off recorded against the platform records the wrong thing.

Information security already offers a model for the companion control this implies, since ISO/IEC 27001 treats the integrity of logs as something to protect and test. Applied to materiel, the practical shift would be from checking the item to checking the record of the item. For a growing share of materiel the record may be the only witness there is. The wider accountability question, what happens when authority moves from a person to a system, is set out in Engineering Trust.

Reading the gap before it opens

The BAE charging letter is a review after the fact. The same pattern may be legible much earlier, in the requirements and rapid procurement cases an organisation writes when it specifies something urgently. A requirement may describe the platform, payload and delivery timeline in careful detail and say nothing about who receipts the materiel or who classifies the licensable components. That requirement has scoped the capability and left the control environment unscoped.

The aggravating factors in the BAE case included a failure to implement effective corrective actions addressing the root causes of reported violations. Compressed timelines are one place where root causes go unaddressed. Where the interval between authorisation and delivery is shorter than the time needed to obtain a licence, appoint a competent person or license a storage site, something has to be waived. Urgent operations sometimes justify a waiver. The question is whether it is recorded as a decision with an owner and a closure date or absorbed into the tempo.

Testing the join

Siloed assurance tends to ask whether each function meets its own requirements. The BAE letter points to a different comparison, between the records the functions keep: whether the inventory record matches the physical asset, and whether the supplier record reflects current ownership and sub-tier structure. The same test applies to the export classification, which should match the configuration and the technical data, and to the shipment record, which should align with the licence and the end-user information. Each of those pairs falls between two owners, and the cyber risk assessment adds one more when it covers the logistics systems the operation depends on.

How disagreement is handled matters as much as the comparison itself. When two sources differ, someone has to decide whether the exception is material. A write-off in particular needs a record assured to an evidential standard as well as an operational one. From stores work, my view is that agreement between records is easy to test, and the harder job is naming who owns the answer when they differ.

Where the functions meet

On this reading, the risk builds where two functions meet, because neither is placed to see it. In the BAE case it ended as 104 charged violations. In ordinary supply chains it may turn up as a readiness gap or an untested ledger, and once custody moves to autonomous systems as a loss with no custodian left to question. Physical verification, adversarial due diligence, export classification and independent inspection already exist. None of them answers by default for the point where they meet.

ISO/IEC 27001 and 42001, and the supply chain engineering taught through MIT's MicroMasters programme (Caplice and Ponce, 2026), describe controls I ran for eighteen years on stores accounts, handovers and inspections. The handover is where they meet. That meeting point tends to stay nobody's job until an organisation makes it somebody's, and it is likely to widen as more of what an enterprise holds rests with systems. Organisations that treat it as an assurance problem before a regulator does may find it cheaper to fix.

The views expressed here are my own and are based on general observations about logistics assurance, procurement, supply chain resilience, trade compliance and governance. They draw only on published sources and do not represent the position of the Royal Navy, the Ministry of Defence or any organisation with which I work. Where autonomous and uncrewed systems are discussed, the argument is made at the level of general pattern and no specific programme, platform or operation is described. Nothing published here reproduces any organisation's internal policy, procedure or assurance output.