Does US law have a notion of supply chain management?

Question

I'm reading about a recent lawsuit filed by Delta Airlines against one of its vendors. Also see Delta Sues Software Provider Over Data Breach and Lawsuits target Delta and vendor for cybersecurity breach.

Delta's position is, the vendor is responsible:

Any liability coming out of that breach, which is minimal, is going to be the responsibility of the vendor, which is [24]7,” said Delta CEO Ed Bastian in an interview with The Atlanta Journal-Constitution. “We’ve been very clear about that. It was their breach, not ours.

In the software security and risk management fields, we would hold Delta Airlines responsible because Delta is responsible for its supply chain. That is, Delta is responsible for its vendors it chooses. See, for example, NIST SP 800-53A, Assessing Security and Privacy Controls in Federal Information Systems and Organizations, Item SA-12.

Does US law not recognize supply chains and not hold companies responsible for them?

If not, then what stops someone or a corporation from setting up corporations to sidestep requirements, regulation and oversight?

---

For the second questions, suppose it would cost a company $10 million dollars to implement a particular program. The company determines it wants to give the money to share holders instead, so they setup an overseas corporation and pays the overseas company $100,000 a year to do the job it was supposed to be doing. It does not matter how poor a job the overseas company is performing since the goal is to offload risk and minimize cost, not comply.

Answer 1

Does US law have a notion of supply chain management?

There is no need for it, since this kind of disputes can be adjudged under contract law. For purposes of legal analysis, supply chain is nothing more than a scenario of independent contracts, each one typically involving different and unrelated parties.

Based on the article(s) you share, Delta simply is trying to shift the blame and intertwine independent contracts: one with the plaintiff customers, the other with its provider. The customers only have standing to sue Delta because that is the entity with which they entered a contract (here, in the form of airfare purchases).

To prevail in a lawsuit against other entities such as the provider, the plaintiff customers would need to resort to other legal theories and be able to prove the additional elements thereof. Here, it seems unlikely that a decision [by the customers] to expand litigation against other entities will facilitate the remedies to which the plaintiff customers are entitled.

The most Delta can do is to file a third-party complaint against the provider, request that the provider be added as co-defendant, or sue the provider separately.

Answer 2

Is there a claim that Delta is not responsible?

Why do you assume that Delta would not be held responsible? The quoted material does not imply that, it may well be that Delta is the directly responsible party for all claims - I'd interpret "Any liability coming out of that breach, which is minimal, is going to be the responsibility of the vendor" as simply asserting that they have legal arrangements in place that the vendor (or the vendor's insurance company) will compensate them in full for these losses - which is how it would be in any company with prudent supply chain management.

Delta would have ultimate responsibility and they'd bear the costs in case if the vendor successfully contests that they were not at fault, or becomes insolvent (which is the answer to the second part of your question); but it's reasonable to expect that in normal business arrangements for "ordinary" failures they can recoup all financial losses where their vendors are at fault.