NIST Special Publication 800-161 is the US National Institute of Standards and Technology’s guidance on cybersecurity supply chain risk management (C-SCRM). It helps organizations identify, assess and reduce the risk that the technology products and services they buy are counterfeit, contain malicious functionality, or are vulnerable because of poor manufacturing or development practices. It was written for federal agencies and is also used by contractors and private organizations as a structure for supplier security. The current version is Revision 1 (May 2022), updated in November 2024. This entry is general information, not legal advice.
At a glance
- It treats supply chain risk as part of overall risk management, not a separate procurement checklist.
- It works at three levels: enterprise, mission and business process, and operational.
- It provides templates for a C-SCRM strategy and implementation plan, a C-SCRM policy and C-SCRM plans.
- Its controls are an overlay of NIST SP 800-53, organized into the same 20 control families.
- Agencies can flow its practices down to contractors through contract requirements.
What problem it solves
Organizations depend on hardware, software, cloud services and service providers they can’t fully inspect. A supply chain attack on one widely used product can reach thousands of customers, and counterfeit or poorly built components can introduce weaknesses nobody planned for. Most buyers have limited visibility into how the technology they acquire is developed, built and delivered.
NIST SP 800-161 gives a structured way to manage that risk across the organization. It ties supplier security to strategy, policy, acquisition and system-level decisions, so the questions asked of a critical supplier are proportionate to the risk and consistent from one purchase to the next.
How it works
Integrate with risk management. C-SCRM is built into the organization’s existing risk management activities rather than run as a stand-alone program.
Set strategy and policy. Leadership sets a C-SCRM strategy, implementation plan and policy that define roles, risk tolerance and priorities. The guide also describes an optional C-SCRM program management office to coordinate the work.
Assess suppliers and products. The organization identifies which suppliers and products are critical, assesses their risk, and decides how to respond. The guide includes example risk factors, scenarios and a scoping questionnaire.
Build it into acquisition. Requirements go into solicitations and contracts, and supplier performance is monitored over the life of the relationship. Practices such as requiring a software bill of materials (SBOM) or evidence of secure development under the Secure Software Development Framework (SSDF) are examples of the kinds of requirements organizations may add.
Apply controls. Supply chain controls, based on NIST SP 800-53, are selected, tailored and documented in C-SCRM plans for individual systems.
Levels
NIST SP 800-161 has no certification or compliance levels. Its structure is three organizational levels, each with its own C-SCRM activities and documents.
| Level | What it covers | Who is typically involved | Typical documents |
|---|---|---|---|
| Level 1: Enterprise | Overall C-SCRM strategy, risk tolerance, governance and policy | Executives, risk, legal, acquisition and security leaders | C-SCRM strategy and implementation plan, C-SCRM policy |
| Level 2: Mission and business process | Applying the strategy to specific business processes, including their requirements for cost, schedule, performance and security | Program managers, procurement, business owners | Process-level strategies, policies and implementation plans |
| Level 3: Operational | Supply chain risk for specific systems across their life cycle | System owners, engineers, security team | C-SCRM plans for systems, control documentation |
There is no NIST certification against SP 800-161. A supplier claiming alignment is describing its own or an assessor’s view; ask for the evidence behind it.
When it matters for buyers
- When selling to US federal agencies or their primes. Supply chain requirements may appear in contracts and questionnaires.
- When choosing critical technology suppliers. Network equipment, security tools, identity platforms and managed service providers deserve deeper review.
- When writing technology contracts. Notification, transparency and right-to-audit terms are easier to justify with a recognized framework behind them.
- When building a supplier security program. The guide offers templates and risk factors that can be scaled down for a mid-sized organization.
Our governance, risk and compliance overview covers advisors and platforms that run supplier risk programs.
Questions to ask vendors
- Where are your products built, and which key components or subcontractors do you rely on?
- How do you protect your development and build systems from tampering, and can you show evidence?
- Can you provide an SBOM for the software we would buy, and how is it kept current?
- How and how quickly will you notify us of a compromise or vulnerability in your products or your own suppliers?
- How do you detect and prevent counterfeit or tampered hardware?
- Will you accept supply chain security terms, including audit rights, in our contract?
How it differs from Third-Party Risk Management (TPRM)
Third-party risk management (TPRM) is the broad practice of assessing and monitoring the risks posed by vendors and partners, including financial, operational, privacy and compliance risk. NIST SP 800-161 is a specific publication focused on the cybersecurity risks in the supply chain for technology products and services, including how they are developed, built and delivered. Many organizations run C-SCRM as part of their TPRM and vendor management programs, using SP 800-161 for depth on critical technology suppliers. It sits within NIST’s Special Publication 800 series and complements the supply chain outcomes in the NIST Cybersecurity Framework (NIST CSF).
Problems this helps with
- A supplier's compromised software or hardware could become our breach
- Government or defense customers asking how we manage supply chain risk
- No structured way to judge which technology suppliers are critical
- Not sure what security terms to put in technology purchase contracts
