Supply Chain Requirements and Processes is the final requirement in NIST 800-171 R3, closing out the net-new Supply Chain Risk Management (03.17) family. It is where the supply chain plan turns into enforced requirements and a working process for finding and fixing supply chain problems. Supply Chain Requirements and Processes (03.17.03) has two (2) parts: establish a process for identifying and addressing weaknesses or deficiencies in supply chain elements and processes, and enforce defined security requirements to protect against supply chain risks and limit the harm from supply chain events. Per the NIST discussion, supply chain elements include organizations, entities, or tools employed for the research, development, design, manufacturing, acquisition, delivery, integration, operations, maintenance, and disposal of systems and system components.
A common difficulty with this requirement is having a supply chain plan with nothing enforcing it. The requirement uses the word enforce deliberately: defined security requirements must actually be applied, not merely written. Teams also miss that identifying weaknesses and addressing them are two separate objectives, so a supplier assessment process that surfaces problems but has no remediation path leaves an objective open.
Where things stand for companies facing the transition from NIST 800-171 R2 to R3:
The following is reproduced verbatim from NIST 800-171 R3, requirement 03.17.03 Supply Chain Requirements and Processes. Only the formatting has been adjusted for readability. This requirement has two (2) lettered parts:
The source control is SR-03 from NIST 800-53. The bracketed assignment in part b is the Organization-Defined Parameter (ODP): the security requirements. Per the NIST discussion, supply chain processes include hardware, software, firmware, and systems development processes, shipping and handling procedures, physical security programs, personnel security programs, and configuration management tools, techniques, and measures to maintain provenance, and weaknesses or deficiencies in supply chain elements or processes represent potential vulnerabilities that can be exploited by adversaries. You can read the requirement directly at NIST 800-171 R3, 03.17.03 (p. 74).
Note that this requirement is titled Supply Chain Requirements and Processes in both NIST 800-171 R3 and NIST 800-171A R3. Some control listings refer to it as Supply Chain Controls and Processes, which reflects the underlying NIST 800-53 control name for SR-03.
One (1) value sits inside this requirement. Depending on your contract, your organization may be permitted to define it. Organizations in the DIB subject to CMMC are not, because the DoD has defined it as policy.
The value below comes from Attachment A of the DoD Chief Information Officer (CIO) memorandum dated 10 April 2025 (signed David W. McKeown). The memo identifies each parameter by requirement sub-part, while NIST 800-171A R3 identifies the same parameter by ODP number. Both identifiers appear below so you can match your System Security Plan (SSP) language to either document.
The assigned value for 03.17.03.b, quoted from the memo:
at a minimum, integrate Supply Chain Risk Management (SCRM) into acquisition/procurement policies, provide adequate SCRM resources, define the SCRM control baseline, establish processes to ensure suppliers disclose significant vulnerabilities and significant incidents
The memo states that its values "will be updated as necessary," so confirm against the current version before writing them into policy.
NIST 800-171A R3 breaks 03.17.03 into four (4) assessment objectives: one (1) Organization-Defined Parameter (ODP) and three (3) determination statements. These AOs are:
Identifying (a[01]) and addressing (a[02]) weaknesses are separate objectives. If you are a DoD contractor, the ODP is specified. Per the DoD-specified ODP value in ComplianceForge's NIST 800-171 R3 Transition Guide, at a minimum this means integrating Supply Chain Risk Management (SCRM) into acquisition and procurement policies, providing adequate SCRM resources, defining the SCRM control baseline, and establishing processes to ensure suppliers disclose significant vulnerabilities and significant incidents. The full guidance on assessment methods and objects, is in NIST 800-171A R3, 03.17.03 (p. 97).
Examine: SCRM policy and procedures; SCRM strategy; SCRM plan; systems and critical system components inventory documentation; system and services acquisition policy and procedures; procedures for the integration of security requirements into the acquisition process; solicitation documentation; acquisition documentation (including purchase orders); shipping and handling procedures; configuration management documentation and records; acquisition contracts for systems or services; service-level agreements; risk register documentation; system security plan.
Interview: personnel with acquisition responsibilities; personnel with information security responsibilities; personnel with SCRM responsibilities.
Test: processes for identifying and addressing supply chain element and process deficiencies.
03.17.03 is net new for R3 and has no corresponding requirement in NIST 800-171 R2, which had no supply chain risk management family:
Mapped against the four (4) AOs, all four (4) are net new (significant effort), with none direct, indirect, or unmapped. The source control, SR-03, has no R2 predecessor. Along with the Supply Chain Risk Management Plan (03.17.01) and Acquisition Strategies, Tools, and Methods (03.17.02), this completes a family in which every single objective is new work for R3.
Source Control in NIST 800-53 R5:
Secure Controls Framework (SCF) Crosswalk
Organizations running a single control set across multiple frameworks can satisfy 03.17.03 through the following SCF controls:
The crosswalks from NIST 800-171 R3 and NIST 800-171A R3 to the SCF are available at no cost through the SCF Set Theory Relationship Mapping (STRM): https://securecontrolsframework.com/start-here/set-theory-relationship-mapping-strm. The STRM also carries the relationship type for each mapping (Equal, Subset Of, Intersects With), which tells you whether an SCF control fully satisfies the requirement or only part of it. Mapping above taken from SCF 2026.3.
The pitfalls for this net-new requirement are about enforcement and supplier disclosure, each of which needs documented evidence of due diligence and due care such as policies, standards, procedures, and configuration screenshots:
Reasonable objective evidence for an assessment is often subjective. The following examples of evidence to address NIST 800-171 R3 03.17.03 are sourced from the SCF Evidence Request List (ERL), available at https://securecontrolsframework.com/free-content/scf-download. These ERL artifacts are mapped to NIST 800-171 R3 03.17.03 through SCF controls. They establish a starting point for discussions on what an organization needs to have for evidence of due diligence and due care to withstand external scrutiny by an assessor or regulator.
Alongside these, keep the System Security Plan (SSP) narrative for 03.17.03 recording the ODP values you adopted.
With all four (4) AOs net new, 03.17.03 is a significant lift that depends on the rest of the 03.17 family being in place. A realistic sequence:
What value does the DoD require for the organization-defined parameter in NIST 800-171 R3 03.17.03? R3 leaves the value to the organization. For the DIB, the DoD set it in the 10 April 2025 memorandum under ODP identifier 03.17.03.b: at a minimum, integrate Supply Chain Risk Management (SCRM) into acquisition/procurement policies, provide adequate SCRM resources, define the SCRM control baseline, establish processes to ensure suppliers disclose significant vulnerabilities and significant incidents.
How many assessment objectives does NIST 800-171 R3 03.17.03 have? NIST 800-171A R3 breaks 03.17.03 into four (4) assessment objectives: one (1) Organization-Defined Parameters (ODPs) and three (3) determination statements. An assessor works through each one separately, so each needs its own evidence.
Which NIST 800-53 R5 control does NIST 800-171 R3 03.17.03 come from? SR-03.
Where does NIST 800-171 R3 03.17.03 sit in the NIST 800-171 R3 Kill Chain? Phase 4d, Risk Management Practices for parts b; Phase 4e, Risk Management Practices for parts a. The Kill Chain is a phased model for sequencing R3 implementation, and it assigns this requirement to that phase.
03.17.03 Supply Chain Requirements and Processes establishes a process for identifying and addressing supply chain weaknesses and enforces defined security requirements to protect against supply chain risks. It is net new for R3 with no R2 predecessor, so all four (4) objectives are new work, and it completes a family in which nothing carries forward. The recurring problem is a documented baseline that nothing enforces. Define your SCRM requirements, resource the program, build processes that both find and fix supplier weaknesses, and get disclosure obligations into your contracts.
Authoritative sources:
Authoritative sources:
This guide reproduces U.S. Government text from NIST 800-171 R3 and NIST 800-171A R3 and references the DoD ODP memorandum of 10 April 2025. It is educational, not legal or assessment advice. Last reviewed: 2026-09-22.
