Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (NIST SP 800-161 Rev. 1)

Summary

The NIST guide explains how to identify, assess and mitigate the cyber risks that come from the supply chain: products and services that may contain counterfeit or tampered components, malicious code, vulnerabilities or poor development practices. It integrates the management of these risks (C-SCRM) into risk management processes at three levels: organisation, mission and business processes, and individual systems. It offers a catalogue of controls derived from SP 800-53, templates for supplier risk strategy, plans and assessments, and guidance on the obligations of federal agencies after Executive Order 14028. It is aimed mainly at US federal agencies, but is also widely used by companies and suppliers.

Information

Jurisdiction

United States

Issuing body

National Institute of Standards and Technology (NIST)

Type

Guideline / framework / standard

Available languages

English

Topics

• Supply chain
• Governance and coordination
• Digital public administration

Notes

Published on 5 May 2022, it supersedes the first version of 2015. Update 1 of 1 November 2024 corrected the text without changing its structure; NIST also provides a fillable version of the supplier assessment scoping questionnaire (Table 26).

National Institute of Standards and Technology (NIST). (2022). Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (NIST SP 800-161 Rev. 1) (NIST SP 800-161 Rev. 1). https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final

National Institute of Standards and Technology (NIST). "Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (NIST SP 800-161 Rev. 1)." 5 May 2022. https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final.

@misc{us_nist_sp_800_161r1_supply_chain_2022,
  author       = {{National Institute of Standards and Technology (NIST)}},
  title        = {{Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (NIST SP 800-161 Rev. 1)}},
  year         = {2022},
  note         = {NIST SP 800-161 Rev. 1},
  url          = {https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final},
  urldate      = {2026-11-02}
}