My job is to make supply chains boring.
Boring means the plan holds, suppliers deliver, and problems get caught upstream before a customer feels them. This card shows you where yours isn't boring yet.
Problems don't stay where they start. A supplier two tiers back can stop a line you run, and most companies can't see that far.[2] That's why the card scores the whole chain, not just the part that's on fire this week.
of surveyed companies had visibility into at least tier-one supplier risk.[2]
could see risk at tier two or beyond.[2]
had mapped their tier-two suppliers, and fewer than half of those had regular direct contact with them.[2]
Source: McKinsey & Company, “Supply chain risk pulse 2025,” Dec 2, 2025, survey of 100 companies.[2]
Eight domains, end to end
The first six domains follow the ASCM SCOR Digital Standard: Orchestrate at Level 0, above six Level-1 processes, Plan, Order, Source, Transform, Fulfill and Return.[1] Visibility and cyber are added, with the cyber statements framed on NIST guidance.[3][4] Each card below shows one of the four statements you'll score.
Plan
SCOR: Plan [1]
One demand plan is agreed by sales, operations, finance and procurement each month.
Source & Procurement
SCOR: Source [1]
Spend is categorized and each top category has a written sourcing strategy.
Make
SCOR: Transform [1]
Production schedules are built from the current demand plan, not last month's.
Risk & Resilience
SCOR: Orchestrate, risk management [1]
We have mapped which suppliers, sites and lanes could stop revenue, and by how much.
Score it, total it, fix the weakest link
Rate each of the 32 statements from 0 (not in place) to 3 (in place, measured and owned).
Add each domain out of 12, then your total out of 96, and find your band.
Any domain at 0–5 is your weakest link, whatever your total. Start there.
| Total | Band | What it means |
|---|---|---|
| 0–24 | Exposed | Gaps in most domains. One disruption likely reaches customers. Start with Risk & Resilience and Visibility. |
| 25–48 | Reactive | Basics exist but depend on people, not process. Fix your two lowest domains first. |
| 49–72 | Managed | Repeatable in most domains. Close the gaps, especially deep-tier visibility and cyber. |
| 73–96 | Resilient | Integrated, tested and owned end to end. Keep testing playbooks and widen supplier visibility. |
Questions, scale and bands are FSA's own scoring, not an industry standard. Domain labels show alignment, not certification. Bands are FSA's rubric, not a benchmark.
Get the card, plus the Weekly Brief
Enter your email to get the card. It also signs you up for The FSA Supply Chain Weekly Brief: supply chain, procurement, distribution and logistics signals in one short read each week.
Thanks. Check the new tab to confirm your subscription. Your card is ready:
Sources
- ASCM, SCOR Digital Standard, “Processes” (accessed Oct 20, 2026). scor.ascm.org/processes
- McKinsey & Company, “Supply chain risk pulse 2025,” Dec 2, 2025 (survey of 100 companies). mckinsey.com/capabilities/operations/our-insights/supply-chain-risk-survey
- NIST SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, May 2022 (updated Nov 1, 2024). csrc.nist.gov/pubs/sp/800/161/r1/upd1/final
- NIST CSWP 29, The NIST Cybersecurity Framework (CSF) 2.0, Feb 26, 2024, category GV.SC. nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf