NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations

NIST SP 800-161 Rev. 1, titled “Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations,” offers comprehensive guidance for organizations to identify, assess, and mitigate cybersecurity risks across their supply chains. It integrates cybersecurity supply chain risk management (C-SCRM) into broader risk management activities through a multi-level approach, including the development of C-SCRM strategies, policies, implementation plans, and risk assessments for products and services. The publication emphasizes managing risks not only in final products but also in their components and the entire supply chain journey. It includes updated controls, metrics, and guidance on risk appetite and tolerance, aligning with U.S. Executive Order 14028 on enhancing software supply chain security. The document supports organizations in building robust third-party risk management programs by addressing acquisition strategies, supplier assessments, notification agreements, and supplier inventory management, thereby improving supply chain integrity and resilience against cyber threats.