NIST SP 800-161
Supply Chain Risk Assessment
Cybersecurity supply chain risk management for organizations that acquire technology from third-party suppliers and need to know what risks come with it.
Overview
NIST SP 800-161 (Rev 1, 2022) is the federal standard for cybersecurity supply chain risk management (C-SCRM). It provides the framework for identifying, assessing, and managing the cybersecurity risks that enter an organization through its technology suppliers: hardware vendors, software developers, cloud providers, managed service providers, and the components embedded throughout the technology stack.
Supply chain compromises are not theoretical. Tampered hardware, backdoored software updates, and vulnerable third-party components have been behind some of the most consequential security incidents of the past decade. Most organizations have a vendor list. Few have a supplier risk program. We assess your current C-SCRM posture against NIST 800-161, identify the gaps, and build the documentation and processes that turn a vendor list into an actual risk management program.
A federal contractor came to us after their agency security reviewer flagged their System Security Plan for missing supply chain risk management documentation. They had 47 vendors providing technology components to their system and no formal process for assessing any of them. We built the supplier inventory, risk-tiered every vendor, and documented the C-SCRM program in six weeks.
Supplier Inventory & Risk Tiering
We build a complete inventory of the technology suppliers that touch your systems and data, then apply a risk-tiering methodology based on criticality, access level, and potential impact of compromise. High-risk suppliers receive deeper scrutiny. The inventory becomes the operational foundation of your C-SCRM program.
C-SCRM Gap Assessment
We assess your current practices against the C-SCRM controls and guidance in NIST 800-161 and the supply chain risk management (SR) control family in NIST SP 800-53. Each practice is evaluated for policy, implementation, and evidence. Gaps are documented with risk context, not just a finding number.
Policy & Program Documentation
We develop or strengthen your C-SCRM policy and plan, establish governance roles and responsibilities, and document your supplier risk criteria and assessment procedures. These documents satisfy the Level 1 program requirements in 800-161 and support FISMA, CMMC, and FedRAMP authorization packages.
Procurement Language & Vendor Controls
Risk management that exists only in policy documents does not reduce risk. We translate your C-SCRM requirements into vendor questionnaire templates, contract language, and third-party assessment procedures that embed supply chain risk controls into your actual procurement and vendor management processes.
Executive Order 14028 (Improving the Nation's Cybersecurity) directed federal agencies to enhance software supply chain security and integrate C-SCRM into their security programs. Contractors and vendors serving federal customers are increasingly being asked to demonstrate they have supply chain risk management programs in place.
What You Can Expect
- Complete supplier inventory with criticality and access classification
- Risk tiering of all in-scope suppliers by potential impact of compromise
- Gap assessment against NIST 800-161 C-SCRM practices and NIST 800-53 SR controls
- Supply chain risk register with identified risks, likelihood, and impact
- C-SCRM policy and plan development or review
- Vendor questionnaire templates and updated procurement language
- Remediation roadmap prioritized by risk severity
- Executive summary suitable for board, agency, or acquisition reporting
Already running a NIST 800-53 assessment? C-SCRM documentation and the 800-53 SR control family assessment can be conducted together to reduce duplication and produce a unified security package. See our NIST SP 800-53 Control Assessment service.
Engagement Fee
Fees are based on the size of your supplier ecosystem, system complexity, and current state of C-SCRM documentation. Contact us for a scoped quote.
* Following initial discovery call, agreement, and deposit.
Who This Is For
- Federal agencies and contractors required to document C-SCRM programs under FISMA, CMMC, or Executive Order 14028
- Organizations pursuing FedRAMP authorization that need to satisfy the 800-53 SR control family and C-SCRM documentation requirements
- Critical infrastructure operators and regulated industries with complex technology vendor ecosystems and no formal supplier risk program
- Organizations that experienced a supply chain incident or near-miss and need to build controls that prevent recurrence
- Procurement and legal teams that need contract language and vendor questionnaire templates to embed C-SCRM requirements into acquisitions
Common Questions
What is NIST SP 800-161 and who should use it?
NIST SP 800-161 (Rev 1, 2022) provides guidance for integrating cybersecurity supply chain risk management (C-SCRM) into an organization's enterprise risk and cybersecurity programs. It applies to any organization that acquires technology products, services, or components from third-party suppliers. Federal agencies are required to implement C-SCRM under FISMA and Executive Order 14028. Defense contractors face supply chain requirements through CMMC and DFARS. Any organization with a complex technology vendor ecosystem benefits from the framework because supply chain compromises have become a primary attack vector.
What are the three levels of the C-SCRM framework?
NIST SP 800-161 organizes C-SCRM across three levels:
- Level 1 (Organization): C-SCRM policy, governance, risk tolerance, program documentation, and integration into acquisition and contracting.
- Level 2 (Mission/Business Process): Mapping of supplier dependencies to specific missions and business processes; C-SCRM requirements embedded in procurement and vendor relationships for each process.
- Level 3 (System/Operational): C-SCRM controls applied to individual systems and components, including hardware and software provenance verification, secure delivery validation, and supplier component monitoring.
Most organizations find their C-SCRM activity concentrated at Level 3 without the governance foundation at Levels 1 and 2, which makes their supply chain risk management reactive rather than systematic.
How does NIST 800-161 relate to NIST SP 800-53?
NIST SP 800-53 Rev 5 includes a dedicated Supply Chain Risk Management (SR) control family with 12 controls covering policy, acquisition strategies, supplier assessments, component authenticity, and supply chain incidents. NIST SP 800-161 is the companion publication that provides detailed implementation guidance for those SR controls and integrates supply chain risk management across the full 800-53 catalog. The two publications are designed to be used together.
What does a C-SCRM assessment actually produce?
A C-SCRM assessment following NIST 800-161 produces a supplier inventory with risk tier classification, a gap analysis against applicable C-SCRM practices and 800-53 SR controls, a supply chain risk register, C-SCRM policy and plan documentation, updated procurement language and vendor questionnaire templates, and a remediation roadmap prioritized by risk severity. For organizations pursuing FISMA compliance or FedRAMP authorization, the C-SCRM documentation becomes part of the system security package.