CHIPS supply chain governance for award recipients

Obligation inventory

Document each statutory or contractual duty in the programme charter so leadership understands what triggers Commerce clawbacks, CISA escalations, or state-level compliance penalties.

• Quarterly supply chain risk reporting. The CISA–Commerce framework mandates quarterly assessments spanning cyber, physical, and geopolitical risk—tie evidence packets to supplier assurance reviews and board reporting cycles.^{CISA & Commerce semiconductor resilience framework}
• 24-hour incident notifications. Adopt joint incident command playbooks so operations can inform Commerce and CISA within 24 hours of production-impacting events, with pre-approved disclosure templates for fabs and tier-one suppliers.^{CISA & Commerce semiconductor resilience framework}
• Infrastructure readiness attestations. Final award agreements release funding only after documenting power, water, and redundant tooling milestones—embed these checkpoints into construction telemetry dashboards and lender reports.^{Micron final award execution}
• Workforce and childcare commitments. Track apprenticeship throughput, childcare coverage, and community investments tied to Jobs First and guardrail provisions so HR and finance can certify compliance each quarter.^{Micron final award executionIntel preliminary memorandum}
• State incentive synchronization. Align New York Green CHIPS or similar tax credit filings with Commerce’s reporting calendar to prevent mismatched attestations from delaying reimbursements.^{Micron final award execution}
• Cyber Performance Goal baselines. Map asset inventories, privileged access controls, centralized logging, and tested recovery runbooks to the cross-sector CPG 2.0 functions so the joint framework’s control benchmarks have measurable owners.^{CISA Cross-Sector Cyber Performance Goals 2.0}

2025 CHIPS award milestone tracker

Commerce executed final CHIPS awards with Micron, Texas Instruments, and GlobalFoundries in the first quarter of 2025, pairing capital disbursements with construction, workforce, and guardrail covenants. The August 2025 semiconductor resilience framework from CISA and the CHIPS Program Office then formalised quarterly risk reporting and 24-hour incident notifications for awardees.^{Infrastructure Briefing — January 9, 2025Infrastructure Briefing — February 13, 2025Infrastructure Briefing — March 17, 2025Infrastructure Briefing — August 20, 2025Commerce & Micron final awardCommerce & Texas Instruments final agreementCommerce & GlobalFoundries fundingCISA semiconductor resilience frameworkCommerce resilience framework fact sheet}

• Micron execution windows. Stage evidence for power, water, cleanroom, childcare, and workforce milestones before each tranche approval; coordinate universal opt-out governance with state incentives to avoid disbursement delays.^{Infrastructure Briefing — January 9, 2025Commerce & Micron final awardMicron U.S. expansion update}
• Texas Instruments Sherman ramp. Map utilities, supplier commitments, and childcare investments tied to the Sherman fabs so Commerce approvals, state partners, and local workforce boards share a single readiness tracker.^{Infrastructure Briefing — February 13, 2025Commerce & Texas Instruments final agreementTexas Instruments Sherman update}
• GlobalFoundries Malta expansion. Integrate specialty-node capacity upgrades, trusted foundry reporting, and third-party supplier diversification metrics into the Malta governance dashboard for Commerce quarterly reviews.^{Infrastructure Briefing — March 17, 2025Commerce & GlobalFoundries fundingGlobalFoundries expansion update}
• Embed resilience framework checkpoints. Align 24-hour incident notifications, quarterly risk assessments, and supplier segmentation controls with the CISA/Commerce framework to satisfy both semiconductor resilience expectations and CHIPS guardrail oversight.^{Infrastructure Briefing — August 20, 2025CISA semiconductor resilience frameworkCommerce resilience framework fact sheet}

Governance dashboards

Surface incentives, supply chain risk posture, and compliance health in a single view reviewed by finance, operations, security, and public policy leads each month.

• Funding tranche tracker. Combine milestone status (utility redundancy, cleanroom commissioning, tool delivery) with Commerce approval states so CFOs see what documentation unlocks the next disbursement.^{Micron final award execution}
• Supplier resilience scoring. Rate wafer fabs, OSAT partners, chemicals, gases, and specialty materials against segmentation tiers, logistics diversification, and redundant tooling coverage set by the CISA/Commerce framework.^{CISA & Commerce semiconductor resilience framework}
• Workforce and childcare KPIs. Plot apprenticeship enrollment, graduation, and childcare slots versus award covenants so community investment teams can pre-empt clawback risk.^{Micron final award executionIntel preliminary memorandum}
• CPG alignment heatmap. Track Identify/Protect/Detect/Respond/Recover goal coverage, including privileged access MFA (CPG.PR.AA), configuration management (CPG.PR.CM), centralized telemetry (CPG.DE.CM), and incident response exercises (CPG.RS.IM), with open remediation tasks and accountable owners.^{CISA Cross-Sector Cyber Performance Goals 2.0}
• Guardrails monitoring. Log board approvals, country-of-concern restrictions, and capital expenditures to prove compliance with statutory CHIPS guardrails before each audit.^{Micron final award execution}

Supplier segmentation and assurance

Segment suppliers by fabrication stage and criticality so mitigations focus on capacity bottlenecks and guardrail exposure.

• Tier definitions aligned to framework controls. Classify fabs, OSAT houses, substrate suppliers, gases, and specialty chemical vendors into tiered groups with minimum redundancy, telemetry, and incident reporting expectations drawn from the joint framework.^{CISA & Commerce semiconductor resilience framework}
• Guardrail vetting for foreign investments. Conduct country-of-concern checks before awarding volume or capital support, documenting waivers and mitigation plans for Commerce reviewers.^{Micron final award execution}
• Supplier workshops. Run quarterly workshops covering reporting templates, evidence expectations, and incident drill cadence so suppliers can hit Commerce review timelines.^{CISA & Commerce semiconductor resilience framework}
• Evidence vault. Store certifications, audit reports, and telemetry exports in version-controlled repositories tied to each supplier tier to streamline quarterly submissions.^{CISA & Commerce semiconductor resilience framework}

Telemetry requirements

Blend OT, IT, and supply chain telemetry so anomalies surface within the 24-hour notification window while supporting Commerce infrastructure reviews.

• Construction and utility instrumentation. Capture real-time power, water, HVAC, and cleanroom metrics so deviations from Commerce readiness baselines generate alerts before site inspections.^{Micron final award execution}
• Supplier telemetry feeds. Require tier-one and tier-two suppliers to stream uptime, WIP inventory, and logistics status into shared dashboards to evidence redundancy and diversification benchmarks.^{CISA & Commerce semiconductor resilience framework}
• CPG-driven logging. Centralise OT protocol monitoring, identity logs, and change management records in line with CPG logging and configuration outcomes to expedite incident reconstruction.^{CISA Cross-Sector Cyber Performance Goals 2.0}
• High-value tool watchlists. Track lithography, metrology, and advanced packaging tool delivery risks, linking mitigations to Commerce infrastructure readiness reviews and supplier segmentation scores.^{Micron final award executionIntel preliminary memorandum}

Recovery and rehearsal cadence

Match the framework’s response expectations with exercises that demonstrate cross-functional readiness for Commerce and CISA observers.

• Joint incident command drills. Rehearse crisis coordination between plant operations, supplier leads, CISA regional advisors, and Commerce programme officers to validate 24-hour notification workflows.^{CISA & Commerce semiconductor resilience framework}
• Supplier continuity exercises. Tabletop simultaneous disruptions at fabs, OSAT partners, and logistics hubs, ensuring redundancy plans satisfy segmentation benchmarks and guardrail requirements.^{CISA & Commerce semiconductor resilience framework}
• After-action and remediation tracking. Feed lessons learned into the governance dashboard with owners, deadlines, and documentation updates so corrective actions are evidenced for the next Commerce review.^{CISA & Commerce semiconductor resilience framework}
• Board-level refreshes. Schedule semi-annual board updates covering risk reporting cadence, incident metrics, and CPG alignment so leadership remains accountable for CHIPS covenant health.^{CISA & Commerce semiconductor resilience frameworkMicron final award execution}

Guide changelog

Document material edits so programme management offices can align schedules, evidence packs, and supplier engagement plans.

Last refreshed

23 November 2025 — surfaced a briefing crosslink section and a deliverable checklist so portfolio leaders can jump straight to Zeph Tech’s Micron final award, GlobalFoundries expansion, and CISA–CHIPS resilience framework research while sequencing tranche evidence and resilience controls.^{Infrastructure Briefing — January 9, 2025Infrastructure Briefing — March 17, 2025Infrastructure Briefing — August 20, 2025}

Next planned review

30 March 2026 — incorporate Commerce 2025 annual reports, supplier resilience metrics, and any updated framework guidance issued after the first year of implementation.^{Infrastructure Briefing — August 20, 2025Commerce resilience framework fact sheet}

Briefings fueling this guide

Link back to the evidence packs cited throughout this guide.

• Infrastructure Briefing — August 20, 2025: CISA & Commerce Semiconductor Supply Chain Framework
• Infrastructure Briefing — January 9, 2025: Micron final CHIPS award agreement
• Infrastructure Briefing — February 13, 2025: Texas Instruments final CHIPS agreement
• Infrastructure Briefing — March 17, 2025: GlobalFoundries Malta expansion funding
• Infrastructure Briefing — March 25, 2024: Intel CHIPS memorandum of terms
• CISA Cross-Sector Cybersecurity Performance Goals 2.0