Electronics Supply Chain Risk Management for Indian Manufacturers

Most electronics manufacturers already keep some kind of risk list. The trouble is that it usually lives in purchasing, gets updated after something has gone wrong, and uses words that mean different things to engineering, quality and finance. A board can stop shipping because a microcontroller is put on allocation, a capacitor lot turns out to be remarked, a laminate change alters a PCB's behaviour, a wireless module loses firmware support, or an imported sub-assembly arrives without the registration it needs. Each of those starts in a different department.

This guide is about the management system that catches them: a shared vocabulary, a BOM-level register, a way to segment lines, a menu of treatments, and a short set of indicators with agreed trigger levels. Recovery planning and disruption exercises are covered separately in the guide to building supply chain resilience for hardware products.

Agree the words before you score anything

ISO 31000:2018 describes risk management as a cycle: identify, analyse, evaluate, treat, monitor and communicate (the standard was last reviewed and confirmed in 2023; checked October 2026). The cycle only works across departments if the terms are shared. Write down, in one page, what your business means by:

• Threat: an event such as allocation, a flood, counterfeit entry or a cyber compromise.
• Vulnerability: a weakness that lets the threat hurt you, such as a sole source, no lot traceability or unsigned firmware.
• Impact: the consequence for production, safety, revenue, compliance or a customer.
• Likelihood: the chance of the event over a stated period, say twelve months.
• Time to recover: how long it would take to restore acceptable supply.
• Owner: the person accountable for the treatment and for escalation.

The definitions matter because each function sees a different risk in the same part. An engineer may call a regulator IC "easily replaceable" while production knows a change means six months of revalidation. Finance may see a buffer as idle working capital; the service team sees warranty cover. One register, in one vocabulary, puts those views side by side.

Build the register from the BOM

Start from the controlled engineering BOM and add risk attributes to each line:

1. manufacturer and exact part number;
2. approved supplier and the type of source;
3. manufacturing, fab and assembly or test sites, where known;
4. firmware, programming tool and licence dependencies;
5. lifecycle status and the route by which change notices arrive;
6. annual usage, stock on hand and lead-time history;
7. qualified alternates and how long qualification took;
8. regulatory or customer approvals that a change would reopen; and
9. revenue, production and safety impact.

Then extend it to sub-assemblies: displays, batteries, power supplies, PCBAs, cables and radio modules. An Indian supplier of a power supply may depend on imported cells, magnetics or ICs, so a local invoice does not prove geographic independence.

Two tools help here. CISA's Hardware Bill of Materials framework, published in 2023, sets out a consistent way for suppliers to describe what is inside a hardware product, which makes shared dependencies easier to spot across suppliers who look unrelated. And for imported lines, remember that India's official trade statistics credit imports largely to the country of consignment, not of origin, according to the Department of Commerce's metadata. You need origin evidence from the supplier, not from customs data.

The guide to reading a BOM for supply risk shows how to fill the first few columns line by line.

Segment the lines

Treat some conditions as pass or fail. A safety requirement, a legal requirement or an authenticity requirement is not traded off against a good price. For everything else, combine likelihood and impact, then adjust for how early you would detect the problem and how long recovery takes.

Do not let averaging hide a fatal condition. A low-probability counterfeit risk on a part in a protection circuit, or a software licence that would stop production programming if it lapsed, can need treatment whatever the score says.

Cover every family of risk

Supply and lifecycle. Track sole sources, capacity concentration, allocation, MOQ and end-of-life status. Record the slow tail of lead times as well as the average: the orders that arrive late are the ones that stop lines. Manufacturer policies set the clock once a notice arrives. Texas Instruments, for instance, says that when it discontinues a product it allows 12 months for last orders and a further six months for final delivery (checked October 2026). The guide to PCN and EOL alerts covers the notice workflow.

Quality and authenticity. Prefer manufacturer or authorised-distributor routes. ECIA's June 2026 position paper on authorised channels lists counterfeit parts, improper storage and handling, and parts of unknown provenance as the risks outside them. Measure defect rate, inspection escapes and corrective-action age by source and by lot.

Logistics and geography. Map ports, airports, consolidation hubs and inland routes. Include monsoon disruption, strikes, carrier concentration and trade restrictions, and keep recovery options specific to each route.

Regulatory. List the finished-product and component dependencies on BIS registration, WPC approval, telecom certification, battery transport rules, e-waste obligations and customer approvals. Give someone the job of watching for amendments and effective dates. A part substitution can trigger retesting even when form, fit and function look identical.

Cyber and intellectual property. Connected products depend on firmware, signing keys, update servers, compilers and programming fixtures. NIST SP 800-161 Rev. 1 Update 1 is the reference for cybersecurity supply chain risk. Ask suppliers, in proportion to risk, for software component inventories, vulnerability disclosure, signed releases, key protection and support periods. Protect Gerbers, firmware, test limits and tooling data with access controls and contract terms that cover return or destruction.

Do due diligence in proportion

Shortlist on capability first: the supplier must make or supply the right family, technology, tolerances and volumes. Then assess the candidates that will carry critical or high lines. NIST SP 1326, finalised in July 2026, is a quick-start guide to supplier due diligence that groups the questions under ownership and control, provenance, resilience, foundational cyber practices, and supply-chain tiers. It was written for ICT buyers, but the headings transfer well to electronics manufacturing.

Screen with documents, clarify on a video call, and visit the site for higher-risk candidates. Audit the factory and process that will make your part, not a sister plant. The forUdyog guide to supplier capability evaluation has a fuller method.

Put the controls into RFQs and contracts

A mitigation that exists only in the register is fragile. RFQs and supply agreements should name the approved MPNs and sites, traceability requirements, change-notice periods, limits on subcontracting, cyber obligations, audit rights and how non-conformances escalate. Ask suppliers to list assumptions and proposed alternates separately from the main offer. Agree who owns tooling, firmware, test software and production records, and how excess stock, cancelled forecasts and last-time buys are handled.

CISA's fact sheet for small and medium businesses makes the same point from the ICT side: supply chain risk practices have to be built into decisions, budgets and operations, with visibility into suppliers and attention to single-source dependence. In practice that means purchasing cannot promise lower risk if engineering will not fund qualification or finance refuses every buffer.

Choose a treatment and record the trade-off

Every critical or high line should carry one of four treatments.

• Avoid: design out the dependency, for example a module with no software support.
• Reduce: qualify an alternate, tighten controls or hold targeted stock.
• Share: use contracts, supplier-held buffers or insurance.
• Accept: write down the reason, the owner, an expiry date and the fallback.

Inventory is only one form of reduction. It protects against disruptions shorter than the cover it provides, and it adds cash, storage and obsolescence exposure. Size it item by item from service level, lead-time spread, forecast error and recovery time.

Watch a short list of indicators every month

A monthly review needs perhaps nine numbers:

• critical lines without a qualified alternate;
• lines that depend on a single site or a single country;
• stock cover compared with the slow-tail lead time;
• past-due orders and changes to supplier commit dates;
• change and EOL notices still waiting for assessment;
• spend through authorised versus exception channels;
• quality escapes and the age of open corrective actions;
• approvals and registrations nearing renewal or change; and
• known vulnerabilities or unsupported firmware in shipping products.

Attach a trigger and an action to each. For example: if cover on a critical line falls below its 90th-percentile replenishment time, purchasing escalates the allocation and engineering starts the alternate plan. Without triggers the dashboard only tells you about failure a little earlier.

A few questions that come up

What is the first step?

A BOM dependency map linked to products, suppliers, sites, stock, lead times and alternates. Without it, priorities are guesses.

How often should suppliers be re-assessed?

On a schedule set by segment, plus event triggers: a quality escape, an ownership change, a relocation, a cyber incident, repeated late deliveries or a major process change.

Does buying locally remove the risk?

It can reduce transit and communication risk. Local suppliers can still carry imported sub-tier, capacity, quality, financial and cyber dependencies, so they go in the register like anyone else.

For qualifying second sources on the critical lines, see the multi-supplier strategy guide.