NIST SP 800-161 Rev. 1 FAQ: practical implementation questions

Use organization-defined supplier categories to focus analysis and treatment based on mission and system dependency, access, criticality, concentration, substitutability, and potential impact. NIST gives strategic/innovative, mission-critical, sustaining, and standard/non-essential as examples, not a mandatory scale or score.

Keep supplier categories separate from SP 800-161's three risk-management levels and from CSF Implementation Tiers. For example, a low-spend component supplier may be mission-critical when it is the only qualified source, while a large office-supply vendor may remain standard/non-essential for the assessed system. The category should drive evidence depth, contract controls, monitoring, contingency planning, and escalation.

Put selected C-SCRM requirements into the solicitation, agreement, inspection method, and contract-management process. NIST recommends coverage for applicable security requirements, relevant subcontractor flow-down, periodic revalidation, vulnerability and incident reporting, and response and recovery roles.

Tailor each term to the supplier's role and assessed risk. State the required result, evidence, review frequency, responsible party, exceptions, corrective action, and remedy. Certifications, site visits, third-party assessments, and self-attestation are possible validation methods, with rigor matched to criticality and assurance need. The applicable acquisition rules and contract determine legal enforceability.

Monitor compliance, effectiveness, and change against a documented baseline. The baseline should identify the supplier, supplied product or service, criticality, access, dependencies, requirements, assessed risks, and accepted exceptions.

Combine organization-set review intervals with off-cycle triggers. NIST does not prescribe one universal supplier-monitoring frequency. Reassess after relevant enterprise or system changes, supplier operational or structural changes, product updates, incidents, serious disruptions, and geopolitical or environmental changes; set the interval and response from criticality, risk conditions, assurance needs, and contract terms.

Use the organization's incident-response and C-SCRM processes together. Validate and prioritize the report, assign an incident lead, scope affected products, versions, services, data, systems, and sub-tiers, and coordinate with the supplier under established plans and agreements.

SP 800-161 does not set one incident-notification deadline. Notification content and timing depend on applicable law, regulation, policy, and contract. Preserve incident data and decisions, contain and eradicate the issue, verify recovery, track corrective action, and reassess the supplier and dependency.

Identify critical suppliers from the importance of the dependency and the impact of failure or compromise. Map the supported mission, business process, system, data, or safety function; access and change authority; concentration and sub-tiers; recovery and replacement time; and qualified alternatives. Include common fourth parties: two prime suppliers can create one critical dependency when both rely on the same cloud, network, component, or other upstream provider.

Criticality is not limited to spend, and it is not the same as supplier risk. A low-cost component can be critical as a single point of failure, while a well-controlled supplier can remain critical because the dependency has not changed.

Provenance should identify the origin, authorized path, custody, changes, and verification of systems, components, software, and associated data through the life cycle. Choose the evidence depth from criticality and the decision it must support.

Bind evidence to the exact item, lot, serial number, version, release, build, or data set. A software bill of materials (SBOM) can improve dependency visibility for purchased, open source, and in-house software, but NIST says it complements rather than replaces vulnerability management and supplier assessment. SP 800-161 sets no universal SBOM delivery deadline; the governing policy or agreement must set delivery and refresh requirements.

Prioritize critical systems and components. Prefer original equipment manufacturers, then authorized distributors, then authorized resellers where feasible. If only a non-authorized distributor or secondary market is available, reassess criticality and threat, investigate the source, and add documented mitigations. Require item-level traceability, apply risk-appropriate tamper and authenticity checks, and control service and repair.

Prevent a suspected item from entering or remaining in use while its status is investigated. Preserve evidence, follow applicable sector and reporting procedures, examine related lots and systems, and reassess the supplier, inventory, alternatives, and continuity plan.

State a risk scenario that connects a threat, vulnerability or exposure, affected dependency, likelihood, and impact. Then compare acceptance, avoidance, mitigation, sharing, transfer, or a combination against risk tolerance, mission needs, cost, feasibility, and decision authority. Acceptance retains the risk within authorized tolerance; avoidance removes the activity or exposure; mitigation reduces likelihood or impact; sharing or transfer reallocates part of the consequence or responsibility but does not erase the enterprise's residual mission risk.

Turn the selected response into funded actions, owners, milestones, measures, and monitoring. Sharing or transfer can reallocate some consequence or responsibility, but the enterprise still needs to identify and monitor residual mission and system risk.