NIST SP 800-161 Rev 1 Compliance - Cybersecurity Supply Chain Risk Management (C-SCRM)

NIST SP 800-161 Rev 1 refers to the First Revision (Rev 1) of National Institute of Standards and Technology Special Publication 800-161 (NIST SP 800-161):

• Publication Title: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations
• Published Date: November 2024

What is NIST SP 800-161 Rev 1?

NIST SP 800-161 was first published in 2015 and the current version (Rev1) was released in November 2024. This publication provides guidance to organizations on identifying, assessing, and mitigating cybersecurity risks throughout the supply chain at all levels of their organizations.

NIST SP 800-161 Rev 1 integrates Cybersecurity Supply Chain Risk Management (C-SCRM) into risk management activities by applying a multilevel, C-SCRM-specific approach that includes guidance on the development of:

• C-SCRM strategy implementation plans;
• C-SCRM policies;
• C-SCRM plans; and
• Risk assessments for products and services.

NIST SP 800-161 Rev 1 is a foundational cybersecurity guidance document that is designed to help manage cybersecurity risks in an organization’s supply chains, which are increasingly being targeted by sophisticated cyber threats. This publication is the US Government's authoritative playbook for securing the supply chain from cyber threats, including initiatives such as the GSA OASIS+ that requires conformity with NIST 800-161 R1. This C-SCRM framework outlines a risk-based, tiered approach to identifying and mitigating risks associated with third-party products, services and vendors. As supply chain attacks become more prevalent and sophisticated, adopting NIST 800-161 R1 is critical for organizations aiming to build a resilient cybersecurity posture in both government and industry settings.

What Is Cybersecurity Supply Chain Risk Management (C-SCRM)?

Cybersecurity Supply Chain Risk Management (C-SCRM) is the process of identifying, assessing and mitigating cybersecurity-related risks in an organization's supply chain that could impact the security and integrity of an organization's products, services and operations.

C-SCRM includes risks associated with the use of third-party vendors, software and other components that make up an organization's broader technology infrastructure. Effective C-SCRM involves identifying potential vulnerabilities and threats in the supply chain and implementing measures to reduce or eliminate those risks. This includes conducting risk assessments, implementing cybersecurity controls and regularly monitoring the supply chain for evolving threats and potential vulnerabilities. C-SCRM also involves working closely with suppliers and vendors to ensure that those External Service Providers (ESP) meet an organization's cybersecurity and privacy requirements to prevent the introduction of additional risks to the organization.

What Is The Purpose of Cybersecurity Supply Chain Risk Managment (C-SCRM) Compliance?

The primary purpose of NIST SP 800-161 is to provide guidance on integrating Cybersecurity Supply Chain Risk Management (C-SCRM) into organizational risk management practices. NIST 800-161 R1:

• Aligns with Executive Order 14028 on improving the nation’s cybersecurity;
• Complements existing cybersecurity frameworks such as NIST 800-53 (cybersecurity and data privacy controls); and
• Aligns with the NIST Cybersecurity Framework (NIST CSF).

NIST 800-161 recognizes that supply chains are global, complex and dynamic, often involving multiple tiers of suppliers. As such, the publication outlines a comprehensive and strategic approach for identifying, assessing and mitigating supply chain-related risks to systems and data.

Key elements from NIST 800-161 R1 include:

• Integration of C-SCRM into Enterprise Risk Management (ERM) processes;
• Establishment of governance structures for managing supply chain risks;
• Development of policies, procedures and controls tailored to supply chain concerns; and
• Assessment and monitoring of suppliers, components and processes throughout the system lifecycle.

NIST 800-161 R1 also encourages organizations to consider C-SCRM risks during all stages. These stages are also included in NIST SP 800-171 Rev 3 compliance (Section 3.17). C-SCRM compliance focuses on:

• Design;
• Development;
• Acquisition;
• Deployment;
• Operations;
• Maintenance; and
• Disposal.

US Government Contract Requirements For NIST SP 800-161 R1

1. 1. A cybersecurity program based on NIST SP 800-171 R2 controls (e.g., policies, standards, procedures and evidence of implementation);
   2. A Cybersecurity Supply Chain Risk Management (C-SCRM) plan based on NIST SP 800-161 R1;
   3. Cybersecurity incident response capability; and
   4. Business continuity / disaster recovery (BC/DR) practices.

Who Needs To Comply With NIST SP 800-161 Rev 1?

There are two (2) key drivers for NIST SP 800-161 Rev 1 compliance:

1. NIST SP 800-171 Rev 3 contains requirements for C-SCRM in section 3.17; and
2. The US General Services Administration (GSA) is including requirements for NIST SP 800-161 Rev 1 compliance in GSA contracts.

While these drivers are the US Government, the C-SCRM nature of NIST SP 800-161 Rev 1 will trickle down across all industries and organization sizes. Examples of organizations that will be caught in trickle down contact requirements for C-SCRM include, but are not limited to:

• Department of Defense (DoD) contractors;
• US federal contractors;
• Technology companies (e.g., software or hardware manufacturers);
• Managed Service Providers (MSPs) / Managed Security Services Providers (MSSP);
• Systems integrators (e.g., professional services, consultants, etc.);
• Manufacturers;
• Higher education (e.g., colleges and universities);
• Healthcare providers; and
• Research institutions.

What Is The Source of NIST SP 800-161 Rev 1 Requirements?

The requirements in NIST SP 800-161 Rev 1 builds upon concepts described in a number of NIST and other publications:

• Cybersecurity controls from NIST SP 800-53 Rev 5 (C-SCRM controls);
• Risk management framework structure from NIST SP 800-37 Rev 2;
• Multilevel risk management approach from NIST SP 800-39; and
• Impact categorization approach from Federal Information Processing Standards (FIPS) Publication 199 (FIPS 199).

Are NIST SP 800-161 R3 Requirements Considered “Best Practices” For C-SCRM?

Yes. NIST SP 800-161 R1 requirements are considered “best practices” for Cybersecurity Supply Chain Risk Management (C-SCRM) practices.

Is NIST SP 800-161 Rev 1 A Contractual Obligation?

Yes. Organizations must implement NIST SP 800-161 Rev 1 requirements as part of a contractual obligation with the US Government that contains contract requirements for NIST SP 800-161. This likely includes a flow down that includes subcontractors, based on the C-SCRM nature of NIST SP 800-161.

What Is The Scope of NIST SP 800-161 Rev 1 Compliance?

NIST SP 800-161 Rev 1 does not provide guidance on scoping. The publication does reference NIST SP 800-30 Rev 1, Guide for Conducting Risk Assessments, as a recommended reference for scoping C-SCRM assessments.

A free guide from ComplianceForge, the Unified Scoping Guide (USG) does provide scoping guidance on a wide range of data types. The USG could be used as a reasonable means to justify the scope of NIST SP 800-161 Rev 1 compliance efforts.

What Are the Penalties For Non-Compliance With NIST SP 800-161 Rev 1?

Compliance with NIST SP 800-161 Rev 1 is not entirely the responsibility of an organization’s cybersecurity department, since it entails a multifaceted approach that requires significant involvement from these key functions:

• Cybersecurity;
• Enterprise Risk Management (ERM); and
• Contracts management.

Currently, compliance with NIST SP 800-161 Rev 1 is “on the honor system” similar to compliance with HIPAA, PCI DSS, GDPR and other common compliance obligations that organizations must comply with. could be a False Claims Act (FCA) violation and the US Department of Justice (DOJ) is taking FCA violations seriously. Additional penalties for non-compliance with NIST 800-171 Rev 2 include, but are not limited to:

• Contract Termination. It is reasonably expected that the U.S. Government will terminate contracts with prime contractors over non-compliance with DFARS / NIST 800-171 requirements since it is a failure to uphold contract requirements. Subcontractor non-compliance will cause a prime contractor to be non-compliant, as a whole.
• Criminal Fraud. If a company states it is compliant when it knowingly is not compliant, that is misrepresentation of material facts. This is a criminal act that is defined as any act intended to deceive through a false representation of some fact, resulting in the legal detriment of the person who relies upon the false information (e.g., False Claims Act).
• Breach of Contract Lawsuits. Both prime contractors and subcontractors could be exposed legally. A tort is a civil breach committed against another in which the injured party can sue for damages. The likely scenario for a DFARS / NIST 800-171-related tort would be around negligence on behalf of the accused party by not maintaining a specific code of conduct (e.g., DFARS / NIST 800-171 cybersecurity controls).

As you can see from those examples, the cost of non-compliance is quite significant. As always, seek competent legal counsel for any pertinent questions on your specific compliance obligations.

How Can I Comply With NIST 800-161 Rev 1?

The term "supply chain security" broadly refers to the measures taken to protect the integrity and reliability of the goods and services that make up an organization's supply chain, which includes suppliers, partners, consultants and other vendors that provide goods or services to that organization. The goal of supply chain security is to ensure that those obtained goods and services are of the highest quality, are free from tampering and were delivered to the intended recipients (e.g., man in the middle supply chain attack). There are several aspects to supply chain security that include, but are not limited to:

• Physical Security: Measures taken to protect the goods and facilities in the supply chain from theft, tampering, and other physical threats;
• Cybersecurity: Measures taken to protect the supply chain from cyber threats, such as malware attacks, data breaches, and unauthorized access;
• Quality Control: Measures taken to ensure that the goods and services being provided meet the required standards of quality and performance;
• Tracking and Traceability: The ability to track the movement of goods and services through the supply chain and identify their point of origin; and
• Risk Management: The identification and assessment of potential risks to the supply chain, and the implementation of measures to mitigate or eliminate those risks.

Ensuring the security of the supply chain is important for the integrity and reliability of goods and services, as well as for the reputation of those organizations involved in the supply chain. The encompassing terminology used to define this broad practice is Supply Chain Risk Management (SCRM).

Editable Cybersecurity Supply Chain Risk Management (C-SCRM) Documentation Templates

Cybersecurity Supply Chain Risk Management (C-SCRM) is the process of identifying, assessing, and mitigating risks to an organization's cybersecurity that are associated with its supply chain. This includes risks that may be introduced by third-party suppliers, contractors and other partners that provide goods, services and/or technology to an organization.

C-SCRM involves understanding the cybersecurity risks and vulnerabilities associated with different parts of the supply chain and implementing measures to minimize or eliminate those risks. This includes, but is not limited to the following activities:

• Conducting risk assessments of potential suppliers and partners to identify potential cybersecurity risks;
• Implementing security controls and safeguards to protect against cyber threats throughout the supply chain;
• Regularly monitoring and testing the supply chain for vulnerabilities and weaknesses;
• Ensuring that contracts and agreements with suppliers and partners include provisions for cybersecurity and data protection; and
• Establishing incident response plans to quickly address and resolve any cybersecurity incidents that occur within the supply chain.

By implementing effective C-SCRM practices, an organizations can (1) help protect itself and its customers from cyber threats and (2) minimize the impact of any security incidents that do occur.

C-SCRM Strategy & Implementation Plan (SIP)

National Institute of Standards and Technology (NIST) SP 800-161 Rev 1, Supply Chain Risk Management Practices for Federal Information Systems and Organizations, is the "gold standard" for C-SCRM practices and provides recommendations for managing supply chain risks. NIST SP 800-161 Rev 1 provides the structure to generate a C-SCRM Strategy and Implementation Plan (SIP).

NIST SP 800-161 R1 covers a wide range of topics related to supply chain risk management, including:

• The importance of supply chain risk management for federal information systems and organizations;
• The process of identifying, assessing, and mitigating supply chain risks;
• The role of risk management in the acquisition of goods and services from external suppliers;
• The use of security controls and safeguards to protect against supply chain risks;
• The role of incident response in managing supply chain risks; and
• The role of contracts and agreements in managing supply chain risks.

Editable C-SCRM Documentation Templates

ComplianceForge offers editable C-SCRM documentation templates that range from policies, standards and procedures to SCRM Plan templates. Contact us for any product-related questions you have to address your NIST 800-161 compliance needs.

• C-SCRM & NIST 800-161 R1

  For many cybersecurity practitioners, even those well versed in NIST 800-171 and Cybersecurity Matur...

• Your CMMC Requirements Guide

  A common issue facing many front-line IT / cybersecurity practitioners is that they do not know wher...

• SCF Cybersecurity Documentation Experts

  ComplianceForge is very pleased to announce it is now a Secure Controls Framework Licensed Cont...

• Affordable Cybersecurity Policy Templates

  ComplianceForge specializes in cybersecurity documentation. We are an industry leader in providing a...

---