Rebecca McWhite (’13): Securing Our Supply Chains

When she turned down her dream job to work in supply chain risk management, Rebecca McWhite (’13) did not yet know that she would soon become a leader in this field. Since then, she has created a due diligence assessment methodology that is used across multiple federal agencies to safeguard the integrity of U.S. supply chains.

As the Cybersecurity Supply Chain Risk Management (C-SCRM) Technical Lead at the National Institute of Standards and Technology, Rebecca protects national interests by helping others identify supply chain risks in our crucial systems. Outside of work, she juggles parenting and supports the Joint Counterintelligence Training Academy (JCITA) as a surveillance role player.

Below, Rebecca discusses the path that led her to IWP, the evolution of her national security career, and the broad impact of her work.

Studying International Affairs

Rebecca discovered her interest in global security issues while taking courses at Johns Hopkins University during high school. “There was a course on weapons of mass destruction that really motivated me,” she remembered. That early experience inspired her to major in East Asian Studies and History at Johns Hopkins.

For graduate school, she sought a more focused academic environment. “Coming from a large university, I wanted to have a more targeted classroom experience for my graduate degree,” she said. “The smaller size was very appealing, and I liked that the faculty had real-world experience.”

Reflecting on her time at IWP, Rebecca said, “It was a lot of fun. I appreciated the flexibility to pursue topics that interested me. By the end of my M.A. program, I was academically a subject matter expert in Chinese military analysis—largely thanks to the professors and courses at IWP.”

Breaking into National Security

Graduating during a recession in 2013 made finding entry-level jobs challenging. Rebecca completed several internships while seeking full-time work.

“I went out after class with some fellow IWP students and asked one of them for help getting an internship on Capitol Hill,” she recalled. “He said sure—and that’s how I started getting involved in policy.”

Her persistence paid off with a contractor position at the Department of Homeland Security. “I was making almost half of what I could have made elsewhere, but I saw it as an investment,” she said. The job enabled her to obtain a security clearance, opening doors to more advanced national security roles.

A Dream Job—And a Tough Decision

With her clearance in hand, Rebecca landed her dream role: analyzing China’s military. “I was doing everything I had studied and was passionate about,” she said. But the contract only lasted six months. Though she was later offered a government position on the same team, the salary was not sustainable.

Her mentor encouraged her to pivot into supply chain risk management—an area closely tied to her expertise in China. She took his advice and embarked on a new career path.

Working in Supply Chain Risk Management

Rebecca began as a Senior SCRM Analyst for a defense contractor and quickly rose through the ranks, eventually serving as a federal civilian SCRM Director of Operations and then SCRM Chief at the Defense Information Systems Agency, a Department of Defense (DoD) combat support agency.

Her team advised DoD personnel on risks associated with sourcing components from unstable or potentially adversarial nations: “For instance, if you’re buying a weapons component from an adversary, how do you mitigate that risk? That’s where we came in,” she explained.

As a GS-14 Branch Chief, she managed teams, coordinated across leadership levels, and developed a risk assessment methodology still in use today.

Innovating at NIST

Rebecca now leads efforts at NIST to strengthen cyber supply chain security across both public and private sectors. Her role blends policy expertise with technical insight, particularly around communications technology and hardware sourced from high-risk regions.

“My current work is very research-focused,” she explained. “I use my operational experience from DoD to guide others through similar supply chain challenges.”

One of her major contributions is NIST SP 1326, NIST Cybersecurity Supply Chain Risk Management: Due Diligence Assessment Quick-Start Guide. This widely used publication offers a practical, scalable template for assessing supply chain risk. It includes guidance on developing a rating scheme for supplier risk, source materials, and detailed steps for implementation.

At least five different agencies are using this guidance for areas ranging from healthcare to defense acquisitions.

Rebecca has also contributed to NIST SP 800-18 Rev. 2, which provides guidance on developing organizational plans to manage security, privacy, and supply chain risks in complex systems.

Both documents are currently in the “Initial Public Draft” stage. Rebecca is currently reviewing feedback from government, industry, and academia, with the goal of refining and finalizing these essential resources. She also plans to create additional “Quick Start Guides,” to help stakeholders quickly address emerging supply chain challenges.

Bringing IWP Lessons to the Field

Rebecca credits IWP with preparing her for the demands of the national security community.

“Besides deepening my knowledge of China, IWP helped me navigate the Intelligence Community. That has been incredibly helpful,” she said. “If I had to highlight one thing IWP taught me, it was how to write for a national security audience. Professor deGraffenreid was especially helpful in teaching me how to communicate complex ideas clearly and concisely to senior stakeholders.”

Supporting Counterintelligence Training

In her spare time, Rebecca serves as a surveillance role player for the JCITA, helping train counterintelligence professionals. She simulates real-world scenarios—such as tailing someone through a city or posing as an intelligence officer under scrutiny—to prepare students for field assignments.

“There is some tradecraft involved,” she said. Her prior private investigator training at IWP came in handy.

In the past, she has assisted with interactive role-playing, memorizing personas, and responding to student interrogation drills.

Rebecca’s husband Steve, who has long been involved in role-playing for national security training, inspired her to join. “He has even acted as an explosion victim during medical simulations,” she said. “Once when he was tailing students during a training exercise, they happened to go into a restaurant near our house. He called and asked me to join him for dinner—and the students didn’t look twice at him once I sat down.”

Rebecca’s path is a compelling example of how expertise, flexibility, and passion can converge in service of national security. From government agencies to training fields, her impact continues to grow—safeguarding the systems we depend on every day.