NIST SP 800-161: Cybersecurity Supply Chain Risk Management (C-SCRM), explained

Last updated: 2026-10-24

Cybersecurity Supply Chain Risk Management (C-SCRM), as defined by NIST Special Publication 800-161, is the practice of identifying, assessing and mitigating the cybersecurity risks that travel through a product or service's supply chain — not just the risks inside an organization's own code or network. The current version is Revision 1 (Update 1), published 1 November 2024, which superseded the original Revision 1 from May 2022; that 2022 release in turn superseded the first SP 800-161, published April 2015. NIST's own abstract for the current release states its purpose is to help organizations with "identifying, assessing, and mitigating cybersecurity risks throughout the supply chain at all levels" — covering risks such as malicious functionality inserted into a component, counterfeit parts, and vulnerabilities introduced by poor manufacturing or development practices upstream of the organization doing the assessing.

Version history: three names for one evolving document

Version	Published	Status
SP 800-161 (original)	April 2015	Superseded
SP 800-161 Rev. 1	May 2022	Withdrawn 1 November 2024
SP 800-161 Rev. 1 (Update 1)	1 November 2024	Current

Because search results and older citations frequently point to the 2022 Revision 1 page, it is worth checking which version a given link resolves to: NIST's own page for the 2022 release now carries a status banner reading "Withdrawn on November 01, 2024. Superseded by SP 800-161 Rev. 1," linking to the Update 1 release referenced throughout this guide.

A multilevel approach, not a single checklist

NIST's abstract for the current release describes SP 800-161 as providing "multilevel C-SCRM-specific guidance" that organizations apply at the enterprise, mission-function, and operational levels — meaning supply chain risk is addressed as a top-level organizational strategy question, as a concern specific to a given mission or business process, and as a concrete set of practices applied to individual systems and components. The publication's core components, per NIST's description, include a C-SCRM strategy and implementation plan, C-SCRM policies, C-SCRM plans, and risk assessments scoped to specific products and services — giving each of the three levels its own artifact rather than one document meant to cover all of them. This guide did not verify the detailed activities NIST specifies at each level against the full PDF text this session; the level names themselves are confirmed from NIST's published abstract, but readers implementing against a specific level should consult the full document.

Where it connects to SP 800-53 and Executive Order 14028

SP 800-161 does not stand alone in NIST's catalogue. SP 800-53 Revision 5 — the general security and privacy control catalogue referenced across US federal and many commercial security programs — lists Supply Chain Risk Management as one of its own named control families, alongside families such as Access Control and Risk Assessment, giving organizations already working from SP 800-53 a direct bridge into C-SCRM-specific controls. Separately, NIST's C-SCRM project page names Executive Order 14028 ("Improving the Nation's Cybersecurity") among the drivers behind its supply chain risk management work. This guide did not independently verify the specific clause-level mapping between EO 14028 and SP 800-161 against a primary federal-procurement source this session; treat that detail as to be confirmed rather than assumed, the same honesty standard this guide applies to NIST SSDF's EO 14028 link — see NIST SSDF (SP 800-218): the four practice groups explained.

Companion publications

Publication	What it adds	Status (as published by NIST)
NISTIR 8276	"Key Practices in Cyber Supply Chain Risk Management: Observations from Industry" — practices drawn from industry experience, published February 2021	Final
SP 1326	"NIST Cybersecurity Supply Chain Risk Management: Due Diligence Assessment Quick-Start Guide"	Final (per NIST's C-SCRM project page, dated 8 July 2026)
SP 800-18 Rev. 2	"Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems"	Final (per NIST's C-SCRM project page, dated 30 June 2026)

Why this matters for device and firmware makers

A firmware or device SBOM answers what components are inside a given release; C-SCRM asks the broader question of how much to trust the suppliers, manufacturing process and development practices that produced those components in the first place, before a single line of firmware is even built. The two are complementary rather than competing: see firmware SBOM: building one when you don't have the source for the component-inventory half of that picture, and IEC 62443-4-1: the secure development lifecycle for a device-specific lifecycle model that a C-SCRM program can sit alongside. Device makers preparing for the EU Cyber Resilience Act's secure-development duties will also find C-SCRM's supplier-facing questions useful groundwork; see CRA Annex I explained.

A workable starting point

Separate the three levels rather than writing one document for all of them. An enterprise-level C-SCRM strategy, a mission-level plan for a specific product line, and operational risk assessments for individual suppliers or components are different artifacts with different owners.
Start risk assessments at the product or component level you already have visibility into — the supplier contracts, the SBOM, or the manufacturing relationship you can actually inspect — rather than attempting an enterprise-wide supply chain map on day one.
Cross-reference SP 800-53's Supply Chain Risk Management control family if your organization already maintains an SP 800-53 control baseline, instead of building a parallel control set from scratch.
Read NISTIR 8276 for industry-sourced practices before drafting your own C-SCRM policy; it was written specifically to capture what organizations with mature supply chain programs are already doing.

SoftWSP's firmware and supply chain assessments give device makers an evidence-backed starting point for the operational-level risk assessments SP 800-161 describes: see device firmware security.

This guide summarises public NIST publications; it does not constitute legal or compliance advice.

Frequently asked questions

What is NIST SP 800-161?

Special Publication 800-161 Revision 1, "Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations," published by NIST in May 2022. NIST's own abstract for the publication states its purpose is to help organizations with "identifying, assessing, and mitigating cybersecurity risks throughout the supply chain at all levels," covering concerns such as malicious functionality, counterfeits and vulnerabilities introduced by poor manufacturing or development practices. It supersedes the original SP 800-161, published April 2015.

Is the version of SP 800-161 I might find online current?

Only if it is Revision 1 with "Update 1" in the label. NIST's publication page for the original Revision 1 (May 2022) carries a status banner reading "Withdrawn on November 01, 2024. Superseded by SP 800-161 Rev. 1" pointing to the Update 1 release, which is the current, active version as of this guide's publication.

What are the three levels of C-SCRM described in SP 800-161?

NIST's abstract for the current (Update 1) release describes the publication as providing "multilevel C-SCRM-specific guidance" at the enterprise, mission-function, and operational levels, so that supply chain risk is addressed both as an organization-wide concern and down at the level of individual systems and components. This guide did not verify the detailed content of each level against the full PDF text this session (the PDF did not extract cleanly); treat the level names as confirmed from NIST's abstract, and the detailed activities at each level as to be confirmed against the full document.

How does SP 800-161 relate to Executive Order 14028?

NIST's C-SCRM project page lists Executive Order 14028 among the drivers for its cyber supply chain risk management work, alongside publications such as NISTIR 8276 and SP 1326. This guide did not independently verify, against a primary federal-procurement source this run, the specific mechanics of any EO 14028 clause-to-SP-800-161 mapping; treat that detail as to be confirmed rather than assumed from this guide.

Does SP 800-53 have its own supply chain control family?

Yes. NIST confirms that SP 800-53 Revision 5 lists "Supply Chain Risk Management" as one of its named control families, alongside families such as Access Control and Risk Assessment. This guide did not verify the exact number of controls inside that family this session; that count is to be confirmed against the full SP 800-53 control catalogue before being cited as a specific figure.