NIST SP 800-161 C-SCRM Guide: Levels, Controls, Steps

Most organisations cannot see how the hardware, software and services they buy were built, by whom, or with what access to their environment, and attackers know it. NIST SP 800-161 Rev. 1 is the US government's main guidance for cybersecurity supply chain risk management (C-SCRM): it tells an organisation how to build supplier risk into governance, acquisition, system plans and the SP 800-53 control baseline. This guide explains what the publication contains as of October 2026, how the three levels and the control overlay work, what it means for supplier credentials and machine identities, and how to implement and evidence it. It is written for security architects, GRC leads, procurement and third-party risk teams, and for executives who own supplier risk.

Key takeaways

The current version is Rev. 1 Update 1. Rev. 1 was published in May 2022 and updated on 1 November 2024; NIST's C-SCRM project page lists no Rev. 2 as of October 2026, but has added SP 1326 (due diligence) and SP 800-18 Rev. 2 (system plans) in 2026.
C-SCRM runs at three levels. Enterprise strategy and policy, mission and business process tailoring, and operational C-SCRM plans for each system, with information flowing back up.
The control overlay sits on SP 800-53 Rev. 5. Appendix A adds supply chain guidance across control families, centred on the SR family (SR-1 to SR-12) plus controls such as SA-4, SA-9, RA-3, RA-9 and PM-30.
Not every supplier gets the same treatment. Criticality drives depth: the most critical suppliers and components get due diligence, contract flowdown, monitoring and joint incident planning.
Supplier access is an identity problem. Vendor accounts, integration service principals, signing keys and CI tokens are where supply chain compromises usually turn into breaches, so C-SCRM must reach into access control and authenticator management.

What it is and who it applies to

SP 800-161 Rev. 1, "Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations", is a NIST Special Publication by Jon Boyens and Angela Smith (NIST) with Boston Consulting Group co-authors. Its abstract frames the problem as limited visibility into how acquired technology is developed, integrated and deployed, with risks including counterfeit products, malicious functionality and poor manufacturing or development practices. The publication integrates C-SCRM into existing enterprise risk management rather than creating a separate discipline.

Item	Status as of October 2026
Current edition	SP 800-161 Rev. 1 Update 1 (final), dated 1 November 2024, DOI 10.6028/NIST.SP.800-161r1-upd1
Superseded	SP 800-161 Rev. 1 of 5 May 2022 (withdrawn 1 November 2024); the original 2015 SP 800-161 before that
Later additions	Fillable SCRM Assessment Scoping Questionnaire (Table 26) released 2 December 2025
Companion guidance	SP 1326 Due Diligence Assessment Quick-Start Guide (final 8 July 2026); SP 800-18 Rev. 2 on security, privacy and C-SCRM plans (final 30 June 2026); NIST IR 8276 Key Practices (February 2021)
Rev. 2	None announced on NIST's C-SCRM project or publication pages when checked on 24 October 2026

US federal agencies: the main audience. NIST's Executive Order 14028 software supply chain guidance directs agencies to apply existing SP 800-161 Rev. 1 controls to their suppliers, and Appendix E covers the Federal Acquisition Supply Chain Security Act (FASCSA).
Contractors and suppliers to government: they meet SP 800-161 indirectly, through contract clauses, supplier assessments and SR-family controls in system baselines.
Everyone else: the publication is voluntary outside government, but it is the most detailed public C-SCRM reference and maps cleanly to NIST CSF 2.0 GV.SC and ISO/IEC 27001 supplier controls. Regulated private sectors use it to structure third-party programmes.

Structure and key requirements

The main body has three sections: an introduction with audience profiles, integration of C-SCRM into enterprise risk management, and critical success factors. Most of the operational value is in the appendices.

Part	What it gives you	Use it for
Section 2	Business case, supply chain risk, the three-level model, roles and the C-SCRM programme management office (PMO)	Programme design and governance
Section 3	Critical success factors: acquisition, information sharing, awareness and training, key practices (Foundational, Sustaining, Enhancing), measurement, dedicated resources	Roadmap and maturity targets
Appendix A	C-SCRM control overlay on SP 800-53 Rev. 5, organised by control family	Tailoring system baselines
Appendix B	Control summary	Quick reference for assessors
Appendix C	Risk exposure framework with threat scenarios	Scenario-based risk assessment
Appendix D	Templates for C-SCRM strategy and implementation plan, policy, plan and risk assessment (including Table 26 scoping questions)	Producing the required documents
Appendix E	FASCSA	Federal exclusion and removal orders
Appendix F	Software supply chain security guidelines under EO 14028	Software acquisition, SBOM, vendor attestation
Appendix G	C-SCRM activities mapped to the risk management process (frame, assess, respond, monitor)	Integrating with SP 800-39 and the RMF

The three levels

Level 1, Enterprise: the C-SCRM strategy, policy and implementation plan set governance, risk appetite and boundaries. This is where executive sponsorship, funding and the PMO decision sit.
Level 2, Mission and business process: mid-level strategies, policies and implementation plans tailor Level 1 direction to particular missions, product lines or business units, including which suppliers are critical to them.
Level 3, Operational: C-SCRM plans for systems determine whether a system meets requirements and has appropriately tailored controls, informed by supply chain risk assessments. The publication expects the plan to be a living document used for continuous monitoring, referencing SR-1, SR-2, SR-6, PL-2, PM-31 and PM-32.

Section 2 calls for a team-based approach drawing on information security, procurement, legal and other disciplines. The PMO can be centralised, decentralised or hybrid, and where one exists it can run product risk assessments as a shared service for Level 3 system owners.

The SR family at the centre of the overlay

Control	Title	What it means in practice
SR-1	Policy and Procedures	A C-SCRM policy owned at Level 1 and procedures at Levels 2 and 3
SR-2	Supply Chain Risk Management Plan	A plan per system or programme, reviewed and updated
SR-3	Supply Chain Controls and Processes	Defined processes to identify and address weaknesses in supply chain elements
SR-4	Provenance	Documented origin and custody of components, for software increasingly SBOM and build provenance
SR-5	Acquisition Strategies, Tools, and Methods	Contract language, approved sources, evaluation criteria
SR-6	Supplier Assessments and Reviews	Assessment before award and periodically afterwards
SR-7	Supply Chain Operations Security	Protecting information about your own supply chain
SR-8	Notification Agreements	Contractual duty to notify of compromises and assessment results
SR-9	Tamper Resistance and Detection	Tamper evidence for hardware and integrity checks for software
SR-10	Inspection of Systems or Components	Inspection triggered by risk or indicators of tampering
SR-11	Component Authenticity	Anti-counterfeit policy and reporting
SR-12	Component Disposal	Secure disposal of components and data

Beyond SR, the controls that carry most supply chain weight are PM-30 (Supply Chain Risk Management Strategy), RA-3 (Risk Assessment), RA-9 (Criticality Analysis), SA-4 (Acquisition Process), SA-9 (External System Services), CM-8 (System Component Inventory) and SI-7 (Software, Firmware, and Information Integrity). See the NIST SP 800-53 Guide.

Key practices and criticality

Section 3 groups practices into Foundational, Sustaining and Enhancing tiers, and NIST's EO 14028 guidance tells agencies to prioritise and tailor software supply chain measures using those tiers. The companion NIST IR 8276 lists eight industry key practices: integrate C-SCRM across the organisation; establish a formal programme; know and manage critical components and suppliers; understand the supply chain; collaborate closely with key suppliers; include key suppliers in resilience and improvement activities; assess and monitor throughout the relationship; and plan for the full life cycle. The publication links the depth of supply chain controls to the criticality of the missions and systems a supplier supports, pointing to NIST IR 8179 for criticality analysis. Requirements are flowed down in contracts to prime contractors and to sub-tier suppliers, balanced against cost and feasibility.

Identity and NHI requirements

SP 800-161 is not an identity standard, but its overlay covers the Access Control (AC) and Identification and Authentication (IA) families, and the incidents that drive C-SCRM almost always pivot through a supplier-held identity. In the SolarWinds compromise, a tampered but properly signed Orion build reached up to 18,000 customers, and attackers then added credentials to application service principals and forged SAML tokens. Treat the following as supply chain controls, not only IAM hygiene.

Supplier identity	Risk	Relevant controls
Vendor and managed service provider user accounts	Standing remote access into production (ATT&CK T1199 Trusted Relationship)	AC-2, AC-6, SA-9; time-bound, approved, recorded access
Integration service principals, OAuth apps and API keys issued to suppliers	Broad scopes that outlive the contract	IA-5, IA-9, AC-6; owner, expiry and scope recorded per credential
Supplier code-signing and release keys	Malicious updates carry a valid signature (T1195.002 Compromise Software Supply Chain)	SR-4, SR-11, SI-7; require signing key protection and provenance in contracts
CI/CD tokens and package publishing credentials of open source and commercial suppliers	Account takeover of a maintainer or bot poisons downstream builds	SR-3, SR-6, SA-15; assess the supplier's build and publishing controls
Agent and connector credentials in SaaS integrations	Third-party compromise reaches your data with no user involved	SA-9, SR-8; notification clauses and credential rotation on supplier incidents

In the supplier questionnaire: ask how the supplier stores and rotates the credentials it holds for you, whether release and commit rights are separated, and whether it uses short-lived tokens for publishing.
In the contract: require notification when a supplier credential with access to your environment is exposed, and the right to revoke and reissue on demand (SR-8).
At offboarding: CSF 2.0 GV.SC-10 expects plans to cover activities after a partnership ends, which in practice means revoking every account, key and token the supplier held.

See the Third-Party Access Guide and the Software Supply Chain Security Guide.

Implementation steps

Secure sponsorship and decide the operating model. Name an executive owner, choose a centralised, decentralised or hybrid PMO, and bring security, procurement, legal, engineering and business continuity into one working group.
Write the Level 1 documents. Use the Appendix D templates for the C-SCRM strategy, implementation plan and policy (PM-30, SR-1). Set risk appetite for supplier types and state which decisions require PMO sign-off.
Build the supplier and component inventory. Join procurement, finance and CMDB data with identity data on vendor accounts and integrations (CM-8, CSF ID.AM-02). Unknown suppliers with live credentials are the first finding most programmes make.
Tier by criticality. Run a criticality analysis (RA-9) for each mission or business process and place suppliers in three or four tiers. Only the top tiers get full due diligence at first.
Assess the critical tier. Use the Table 26 scoping questionnaire and SP 1326 due diligence areas: foreign ownership, control or influence; provenance; resilience; foundational cyber practices; and supply chain tiers (SR-6, RA-3).
Update acquisition. Add C-SCRM clauses to templates: notification (SR-8), provenance and SBOM delivery (SR-4), secure development attestation, access and credential handling, flowdown to sub-tier suppliers, and audit rights (SR-5, SA-4).
Tailor system baselines. Apply the Appendix A overlay to high-impact systems first and write C-SCRM plans per system, or as part of the system plans described in SP 800-18 Rev. 2 (SR-2, PL-2).
Pilot, then extend. Pilot with one business unit and five to ten critical suppliers, review effort and findings after a quarter, then extend to the next tier. Rollback is a procurement decision, not a technical one: keep a documented exception process so urgent buys are not blocked while the programme matures.
Monitor and exercise. Move to continuous monitoring (PM-31) of critical suppliers, include them in incident response and recovery tests, and feed Level 3 findings back into Level 1 and 2 strategy. See the Supply Chain Compromise Response Playbook.

Small and large organisations

Decision	Smaller organisation	Large or federal organisation
Programme form	One owner inside security or GRC, part-time working group	Dedicated PMO, often hybrid with business unit leads
Levels	Levels 1 and 2 combined into one strategy and policy	Separate Level 2 plans per mission or product line
Assessment depth	Questionnaire plus evidence review for the top 10 to 20 suppliers	Full due diligence including FOCI research and sub-tier mapping
Control overlay	SR family and supplier access controls on critical systems only	Appendix A overlay across moderate and high baselines
Software suppliers	Require SBOM and notification clauses on renewal	Appendix F measures, attestation and verification for EO-critical software

Evidence and assessment

Assessors look for documents at each level and proof that they drive decisions. The publication itself stresses that the plan should be used, not written for compliance.

Level 1: approved strategy, implementation plan and policy, PMO charter, risk appetite statement, board or executive reporting.
Level 2: criticality analyses per mission, supplier tiering, tailored policies and acquisition templates.
Level 3: C-SCRM plans per system, completed supplier assessments, SBOMs and provenance records, inspection and authenticity records, access reviews of supplier accounts and credentials.
Logs to keep: vendor account sign-ins and privileged sessions, creation of credentials on integration service principals, software update and signature verification events, and procurement exceptions.

Metrics that show it is working

Percentage of critical suppliers with a current assessment (target: all, refreshed at least annually).
Percentage of new contracts with C-SCRM clauses, including notification and flowdown.
Supplier-held credentials with a named owner, scope and expiry, as a share of all supplier credentials.
Median time to revoke supplier access after contract end or a supplier incident.
Percentage of critical software with a delivered SBOM and verified signatures.
Number of critical suppliers included in an incident response or recovery exercise in the last 12 months.

Mapping to other frameworks

SP 800-161 area	SP 800-53 Rev. 5	NIST CSF 2.0	ISO/IEC 27001:2022 Annex A	MITRE ATT&CK
Strategy, policy, PMO	PM-30, SR-1	GV.SC-01	5.19 Information security in supplier relationships	n/a
Criticality and supplier inventory	RA-9, CM-8	GV.SC-04	5.19, 5.9	n/a
Contract requirements and flowdown	SR-5, SR-8, SA-4	GV.SC-05	5.20 Addressing information security within supplier agreements, 5.21 ICT supply chain	n/a
Supplier assessment and monitoring	SR-6, RA-3, SA-9	GV.SC-07	5.22 Monitoring, review and change management of supplier services	T1199 Trusted Relationship
Provenance, authenticity, integrity	SR-4, SR-11, SI-7	PR.PS-06	5.21, 8.30 Outsourced development	T1195 Supply Chain Compromise, T1195.002
End of relationship	SR-12, AC-2	GV.SC-10	5.22	n/a

For software producers, SP 800-161 Appendix F and the NIST Secure Software Development Framework are complementary: one is the acquirer's view, the other the producer's. See the NIST Secure Software Development Framework (SSDF, SP 800-218) Guide and the SBOM Guide.

Common pitfalls

Questionnaire-only programmes. Annual questionnaires without evidence, monitoring or contract leverage satisfy SR-6 on paper but miss what changes between reviews. IR 8276 is explicit that assessment continues throughout the relationship.
Treating all suppliers alike. Assessing 2,000 vendors at the same depth exhausts the team and leaves the 20 that matter under-examined. Tier first.
Ignoring open source and sub-tier dependencies. The XZ Utils backdoor came through a maintainer persona that gained release rights over about two years, with malicious code hidden in release tarballs rather than the visible source. No vendor contract would have covered it; provenance checks and SBOM-based exposure lookups would have helped.
Trusting signatures as proof of safety. Signed updates prove origin, not integrity of the build. SolarWinds customers received validly signed malicious code, so assessments need to ask about build environment security, not only signing.
Forgetting supplier credentials at offboarding. Contracts end, accounts and API keys remain. Tie supplier identity lifecycle to contract records.
Procurement bypass. Credit-card SaaS, free tools and browser extensions never pass through acquisition, so C-SCRM clauses never apply. Detect them through identity and network data, not purchase orders.

Practitioner checklist

Confirm you are using SP 800-161 Rev. 1 Update 1 and the 2025 fillable Table 26 questionnaire.
Appoint an executive owner and document the PMO operating model.
Publish a Level 1 C-SCRM strategy, implementation plan and policy from the Appendix D templates.
Run a criticality analysis and tier suppliers before assessing any of them.
Assess critical suppliers against the SP 1326 due diligence areas and record evidence.
Add notification, provenance, SBOM, credential handling and flowdown clauses to contract templates.
Inventory every account, key and token held by or issued to suppliers, with owner, scope and expiry.
Apply the Appendix A overlay and SR controls to high-impact systems and write C-SCRM plans.
Include critical suppliers in at least one incident response or recovery exercise a year.
Report the six metrics above to the executive owner each quarter.

NIST SP 800-161 Cyber Supply Chain Risk Management Guide: C-SCRM Practices and Supplier Controls