NIST SP 800-161, "Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations," is the US federal government's primary guidance for what it calls C-SCRM - cyber supply chain risk management. The current version, Revision 1, was published in May 2022 and updated on 1 November 2024 (Update 1, which added a fillable SCRM Assessment Scoping Questionnaire as supplemental material). It is guidance rather than a self-executing mandate, which is the single biggest thing to understand before mapping a TPRM program to it: 800-161 does not carry statutory penalties the way DORA or NIS2 do. Its authority comes instead from FISMA and OMB policy, which require federal agencies to implement the NIST SP 800-53 control catalog that 800-161 operationalizes, and from federal contract clauses that flow the same expectations down to contractors and their suppliers.
The multilevel approach
800-161 applies the same three-tier risk hierarchy NIST uses across its Risk Management Framework, specific to supply chain risk: Level 1 (organization) sets C-SCRM strategy, policy, and risk tolerance from the top; Level 2 (mission/business process) translates that strategy into how specific business functions identify and prioritize the suppliers and products that support them; and Level 3 (operational/system) is where individual systems select, implement, and assess the actual controls. The point of separating the three is that a supply chain risk accepted at the organization level - say, tolerating a sole-source supplier for a low-criticality tool - is a different decision than accepting it for a system supporting a critical mission function, and 800-161 expects the assessment to happen at the level where the consequence actually lands.
The SR control family: where 800-161 gets operational
800-161's practices are anchored to the Supply Chain Risk Management (SR) family in NIST SP 800-53 Revision 5 - twelve controls, SR-1 through SR-12, unchanged by the August 2025 Release 5.2.0 update (which added software-patching controls elsewhere in the catalog, not to the SR family). A handful do most of the practical work:
| Control | What it requires |
|---|---|
| SR-1 Policy and Procedures | A documented C-SCRM policy: purpose, scope, roles, and management commitment - the baseline every other SR control assumes exists. |
| SR-2 Supply Chain Risk Management Plan | A plan for managing supply chain risk across the system development life cycle, reviewed and updated on a defined schedule. |
| SR-3 Supply Chain Controls and Processes | Established processes to identify and address weaknesses or gaps in supply chain elements, tied to the organization's risk tolerance. |
| SR-5 Acquisition Strategies, Tools, and Methods | Procurement approaches - diversifying suppliers, using blind or filtered buys - chosen specifically to protect against and detect supply chain risk. |
| SR-6 Supplier Assessments and Reviews | Assessing and reviewing the supply chain risk associated with a supplier and the products or services it provides, on a defined frequency. |
| SR-8 Notification Agreements | Contractual requirements for suppliers to notify the organization of supply chain compromises and results of their own assessments. |
| SR-10 Inspection of Systems or Components | Inspecting systems or components for tamper indicators at defined points in the supply chain. |
| SR-11 Component Authenticity | Anti-counterfeit policy and procedures, including component tracking through the supply chain. |
| SR-12 Component Disposal | Sanitization and disposal requirements for system components at end of life - the SR family's own version of offboarding. |
800-161 does not just point to this catalog and stop. It adds C-SCRM-specific tailoring guidance, supplemental discussion for each control, and the assessment questionnaire from the November 2024 update - work meant to help an organization decide which SR controls apply at which level, not just check a box that a control "exists."
Where it sits relative to Executive Order 14028 and the SSDF
Executive Order 14028, "Improving the Nation's Cybersecurity" (May 2021), is what pushed NIST to sharpen its supply chain guidance across several publications at once, and it is easy to conflate the results. 800-161 is the general C-SCRM program framework: policy, risk assessment, and supplier oversight for any product or service entering the supply chain. NIST SP 800-218, the Secure Software Development Framework (SSDF), is narrower and different in kind - practices a software producer follows internally to reduce vulnerabilities in the code it ships, referenced by EO 14028's software attestation requirements. A vendor can satisfy SSDF-aligned attestation questions about its own development practices while still being a poor fit under an 800-161-style C-SCRM assessment on other grounds, such as concentration risk or subcontractor opacity - the two frameworks answer different questions and neither substitutes for the other.
What 800-161 does not do
Unlike DORA or NIS2, 800-161 sets no statutory penalty, no fixed incident-reporting clock, and no register any regulator collects. It is a control catalog and an assessment methodology, not an enforcement regime - which means its real-world bite depends entirely on what flows down through FISMA compliance obligations for the agency itself and through contract language for everyone downstream of it. It also leans on self-assessment: SR-6 requires assessing suppliers, but 800-161 does not mandate how, which is exactly the gap between a self-reported questionnaire and evidence-based scoring that shows up across US frameworks more broadly. And its supplier-assessment language is written around a direct supplier relationship; extending that visibility to subcontractors is closer to the explicit subcontracting due-diligence duty DORA's Commission Delegated Regulation 2025/532 imposes on EU financial entities than to anything 800-161 spells out - see fourth-party risk for why that gap matters.
Turning 800-161 into a working program
- Start with SR-1 and SR-2: a documented C-SCRM policy and plan are the prerequisite every other SR control and every audit conversation assumes exists.
- Tier suppliers before assessing them - SR-6's "defined frequency" only means something once you know which suppliers warrant frequent review, the discipline covered in vendor tiering.
- Write SR-8's notification duty into contracts explicitly rather than assuming a supplier will volunteer a compromise; it is a contractual control, not an automatic one.
- Don't stop at the direct supplier. SR-3's "supply chain elements" language reaches subcontractors in principle even where 800-161 is thin on subcontractor-specific mechanics - build that visibility deliberately.
- Treat the assessment as continuous, not annual. 800-161 sets a "defined frequency" for SR-6, not a mandated cadence - continuous monitoring is a stronger default than a once-a-year review, especially for higher-tier suppliers.
Mapping controls to evidence, not just to paperwork
Governance-heavy platforms such as OneTrust and ProcessUnity are built to hold the SR-1/SR-2 policy and plan artifacts and the audit trail an assessor will ask for. BitSight, SecurityScorecard, and UpGuard contribute externally observed signal that can inform an SR-6 supplier assessment without relying solely on what a supplier self-reports. Rescana's approach is to pair automated evidence collection with continuous external monitoring so an SR-6 review reflects current, verified information rather than a questionnaire filed once at onboarding - the same gap this cluster covers generally in evidence-based risk scoring. No platform makes 800-161 compliance automatic; the controls still require a documented policy, a risk tolerance, and human judgment on what to accept.
Frequently asked questions
What is NIST SP 800-161?
NIST SP 800-161, "Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations," is the primary US federal guidance for cyber supply chain risk management (C-SCRM). Revision 1 was published in May 2022 and updated in November 2024. It defines a multilevel approach - organization, mission/business process, and operational/system - for identifying, assessing, and mitigating the cybersecurity risk that products, services, and their suppliers introduce into an organization's supply chain, and it operationalizes that approach through the Supply Chain Risk Management (SR) control family in NIST SP 800-53.
Is NIST SP 800-161 mandatory?
Not directly. NIST SP 800-161 is guidance, not a statute, and it carries no fines of its own. Its practical force comes from FISMA and OMB policy, which require federal agencies to implement the NIST SP 800-53 control catalog - including the SR supply chain family that 800-161 operationalizes - and from federal contracts, which flow equivalent requirements down to contractors and, in turn, their suppliers. Organizations outside the federal ecosystem adopt it voluntarily as a best-practice C-SCRM framework rather than as a legal obligation.
What is the SR control family in NIST SP 800-53?
The SR (Supply Chain Risk Management) family is a set of twelve controls, SR-1 through SR-12, added to NIST SP 800-53 Revision 5 to address cybersecurity risk in the supply chain. It covers a C-SCRM policy and plan (SR-1, SR-2), processes for identifying supply chain weaknesses (SR-3), acquisition strategies chosen to reduce supply chain risk (SR-5), supplier assessments and reviews (SR-6), contractual notification agreements for supply chain compromises (SR-8), inspection for tamper indicators (SR-10), anti-counterfeit component authenticity controls (SR-11), and secure component disposal (SR-12). The family was unchanged by NIST's August 2025 Release 5.2.0 update to SP 800-53.
How is NIST SP 800-161 different from DORA or NIS2?
NIST SP 800-161 is US federal guidance operationalized through a control catalog (the SP 800-53 SR family); it sets no statutory penalty and no regulator-collected register, and its force depends on FISMA compliance obligations and contract flow-down rather than direct legal liability. DORA and NIS2 are EU law: DORA prescribes specific mechanics for financial entities - a Register of Information, pre-contract concentration-risk assessment, named contractual clauses - with fines up to a percentage of global turnover, and NIS2 makes supply-chain security a mandatory measure across most sectors with its own incident-reporting clock and penalties. An organization can be expected to satisfy 800-161-style controls internally while separately carrying binding EU obligations if it does business with EU financial entities or falls under NIS2's scope.