--- title: "NIST SP 800-161 Rev. 1 FAQ: practical implementation questions" canonical_url: "https://www.sorena.io/artifacts/global/nist-sp-800-161-rev-1/faq" source_url: "https://www.sorena.io/artifacts/global/nist-sp-800-161-rev-1/faq/items" author: "Sorena AI" description: "Standalone NIST SP 800-161 Rev. 1 FAQ questions with source-linked answers, implementation checklists, and evidence guidance." published_at: "2026-05-09" updated_at: "2026-05-09" keywords: - "NIST SP 800-161 Rev. 1 FAQ" - "NIST questions" - "implementation answers" - "evidence checklist" - "NIST SP 800-161" - "C-SCRM" - "Supplier risk" --- **[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform [Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io) --- # NIST SP 800-161 Rev. 1 FAQ: practical implementation questions Standalone NIST SP 800-161 Rev. 1 FAQ questions with source-linked answers, implementation checklists, and evidence guidance. *FAQ* *GLOBAL* *NIST SP 800-161 Rev. 1* ## NIST SP 800-161 Rev. 1 FAQ: practical implementation questions Answers to practical NIST SP 800-161 Rev. 1 questions with source-linked implementation guidance. Use the cited NIST sources to turn framework language into owners, evidence, review cadence, and decisions that a reader can act on. NIST SP 800-161 Rev. 1 is NIST's guide to cybersecurity supply chain risk management (C-SCRM) for systems and organizations. It helps teams identify, assess, and mitigate cybersecurity risks throughout the supply chain, and it is useful for people who work in procurement, security, engineering, risk management, and system operations. Use these FAQs when a team needs a short answer that still preserves scope, evidence, and source accuracy. Each answer should stand alone in search results and link back to the practical workflow pages. ## Browse sub-FAQ modules ### [How should teams handle counterfeits under NIST SP 800-161 Rev. 1 supply-chain risk management?](/artifacts/global/nist-sp-800-161-rev-1/faq/counterfeits.md) How should teams handle counterfeits under NIST SP 800-161 Rev. 1 supply-chain risk management? Clear, source-linked guidance with practical evidence checks, owner decisions, and implementation steps. - 2 items ### [How should teams handle critical suppliers under NIST SP 800-161 Rev. 1 supply-chain risk management?](/artifacts/global/nist-sp-800-161-rev-1/faq/critical-suppliers.md) How should teams handle critical suppliers under NIST SP 800-161 Rev. 1 supply-chain risk management? Clear, source-linked guidance with practical evidence checks, owner decisions, and implementation steps. - 2 items ### [How should teams handle monitoring under NIST SP 800-161 Rev. 1 supply-chain risk management?](/artifacts/global/nist-sp-800-161-rev-1/faq/monitoring.md) How should teams handle monitoring under NIST SP 800-161 Rev. 1 supply-chain risk management? Clear, source-linked guidance with practical evidence checks, owner decisions, and implementation steps. - 2 items ### [How should teams handle provenance under NIST SP 800-161 Rev. 1 supply-chain risk management?](/artifacts/global/nist-sp-800-161-rev-1/faq/provenance.md) How should teams handle provenance under NIST SP 800-161 Rev. 1 supply-chain risk management? Clear, source-linked guidance with practical evidence checks, owner decisions, and implementation steps. - 2 items ### [How should teams handle supplier incidents under NIST SP 800-161 Rev. 1 supply-chain risk management?](/artifacts/global/nist-sp-800-161-rev-1/faq/supplier-incidents.md) How should teams handle supplier incidents under NIST SP 800-161 Rev. 1 supply-chain risk management? Clear, source-linked guidance with practical evidence checks, owner decisions, and implementation steps. - 2 items ### [How should teams handle supply chain risk response under NIST SP 800-161 Rev. 1 supply-chain risk management?](/artifacts/global/nist-sp-800-161-rev-1/faq/supply-chain-risk-response.md) How should teams handle supply chain risk response under NIST SP 800-161 Rev. 1 supply-chain risk management? Clear, source-linked guidance with practical evidence checks, owner decisions, and implementation steps. - 3 items ### [How should teams handle tiering under NIST SP 800-161 Rev. 1 supply-chain risk management?](/artifacts/global/nist-sp-800-161-rev-1/faq/tiering.md) How should teams handle tiering under NIST SP 800-161 Rev. 1 supply-chain risk management? Clear, source-linked guidance with practical evidence checks, owner decisions, and implementation steps. - 2 items ### [Which contract controls should teams define under NIST SP 800-161 Rev. 1?](/artifacts/global/nist-sp-800-161-rev-1/faq/contract-controls.md) Which contract controls should teams define under NIST SP 800-161 Rev. 1? Clear, source-linked guidance with practical evidence checks, owner decisions, and implementation steps. - 2 items Browse all indexed questions: [/artifacts/global/nist-sp-800-161-rev-1/faq/items](/artifacts/global/nist-sp-800-161-rev-1/faq/items.md) ## All FAQ items *Page 1 of 1. Showing 17 of 17 items.* ### [What should teams do about counterfeit risk under NIST SP 800-161 Rev. 1?](/artifacts/global/nist-sp-800-161-rev-1/faq/counterfeits.md#what-should-teams-do-about-counterfeit-risk-under-nist-sp-800-161-rev-1) *Module: [How should teams handle counterfeits under NIST SP 800-161 Rev. 1 supply-chain risk management?](/artifacts/global/nist-sp-800-161-rev-1/faq/counterfeits.md)* Handle counterfeits by defining the exact scope, owner, source-linked requirement, evidence artifact, and change trigger before making a public, customer-facing, audit, procurement, or internal control claim. - Define the counterfeits scope and source-linked trigger before assigning the work. - Create evidence that proves the counterfeits decision for the specific product, service, supplier, control, certificate profile, or implementation context. - Set a change trigger so the answer is reviewed after material source, product, supplier, platform, audit, or process changes. Sources for this answer: - [NIST SP 800-161 Rev. 1 Update 1 C-SCRM](https://doi.org/10.6028/NIST.SP.800-161r1-upd1?ref=sorena.io) - Primary NIST source for cybersecurity supply chain risk management practices. - [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach. - [NIST SP 800-53 Rev. 5 Controls](https://doi.org/10.6028/NIST.SP.800-53r5?ref=sorena.io) - Primary NIST source for the integrated security and privacy control catalog. ### [What evidence should support counterfeits under NIST SP 800-161 Rev. 1?](/artifacts/global/nist-sp-800-161-rev-1/faq/counterfeits.md#what-evidence-should-support-counterfeits-under-nist-sp-800-161-rev-1) *Module: [How should teams handle counterfeits under NIST SP 800-161 Rev. 1 supply-chain risk management?](/artifacts/global/nist-sp-800-161-rev-1/faq/counterfeits.md)* Use NIST SP 800-161 Rev. 1 counterfeit-risk criteria to translate counterfeit response planning into an implementation workflow: define the decision, attach evidence, assign ownership, document gaps, and set a reassessment trigger. - Write the decision and scope in one sentence. - Attach the source-linked evidence that proves the current state. - Name the accountable owner and backup reviewer. - Record unresolved gaps, accepted risk, and dependencies. - Set a date or event trigger for reassessment. Sources for this answer: - [NIST SP 800-161 Rev. 1 Update 1 C-SCRM](https://doi.org/10.6028/NIST.SP.800-161r1-upd1?ref=sorena.io) - Primary NIST source for cybersecurity supply chain risk management practices. - [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach. - [NIST SP 800-53 Rev. 5 Controls](https://doi.org/10.6028/NIST.SP.800-53r5?ref=sorena.io) - Primary NIST source for the integrated security and privacy control catalog. ### [How should teams handle critical suppliers under NIST SP 800-161 Rev. 1 supply-chain risk management?](/artifacts/global/nist-sp-800-161-rev-1/faq/critical-suppliers.md#how-should-teams-handle-critical-suppliers-under-nist-sp-800-161-rev-1-supply-chain-risk-management) *Module: [How should teams handle critical suppliers under NIST SP 800-161 Rev. 1 supply-chain risk management?](/artifacts/global/nist-sp-800-161-rev-1/faq/critical-suppliers.md)* Handle critical suppliers by identifying which suppliers support the enterprise's most strategic or operationally important products and services, then grouping them by criticality so the highest-risk relationships receive the most attention. - Build a current inventory of supplier relationships, contracts, products, and services. - Map suppliers into criticality groupings such as mission-critical, sustaining, or standard/non-essential. - Focus additional due diligence and monitoring on suppliers that support critical missions, business processes, or single-source dependencies. - Use the criticality result to guide contract language, evaluation criteria, and contingency planning. Sources for this answer: - [NIST SP 800-161 Rev. 1 Update 1 C-SCRM](https://doi.org/10.6028/NIST.SP.800-161r1-upd1?ref=sorena.io) - Primary NIST C-SCRM source for identifying critical suppliers, assigning supplier-risk owners, and keeping supplier monitoring evidence reviewable. - [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach. - [NIST SP 800-53 Rev. 5 Controls](https://doi.org/10.6028/NIST.SP.800-53r5?ref=sorena.io) - Primary NIST source for the integrated security and privacy control catalog. ### [What evidence should support critical suppliers under NIST SP 800-161 Rev. 1?](/artifacts/global/nist-sp-800-161-rev-1/faq/critical-suppliers.md#what-evidence-should-support-critical-suppliers-under-nist-sp-800-161-rev-1) *Module: [How should teams handle critical suppliers under NIST SP 800-161 Rev. 1 supply-chain risk management?](/artifacts/global/nist-sp-800-161-rev-1/faq/critical-suppliers.md)* Keep the evidence tied to the supplier inventory and the criticality decision. A reader should be able to see which supplier was reviewed, why it was classified as critical or non-critical, and what follow-up actions came from that decision. - Write down the supplier name, product or service, and the business process or mission it supports. - Record the criticality category and the reason for that rating. - Note whether the supplier is a single point of supply or has limited alternatives. - Link the decision to the contract, assessment, or contingency record that will be reviewed again when conditions change. Sources for this answer: - [NIST SP 800-161 Rev. 1 Update 1 C-SCRM](https://doi.org/10.6028/NIST.SP.800-161r1-upd1?ref=sorena.io) - Primary NIST C-SCRM source for identifying critical suppliers, assigning supplier-risk owners, and keeping supplier monitoring evidence reviewable. - [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach. - [NIST SP 800-53 Rev. 5 Controls](https://doi.org/10.6028/NIST.SP.800-53r5?ref=sorena.io) - Primary NIST source for the integrated security and privacy control catalog. ### [Practical monitoring workflow](/artifacts/global/nist-sp-800-161-rev-1/faq/monitoring.md#practical-monitoring-workflow) *Module: [How should teams handle monitoring under NIST SP 800-161 Rev. 1 supply-chain risk management?](/artifacts/global/nist-sp-800-161-rev-1/faq/monitoring.md)* Handle monitoring by defining the exact scope, owner, source-linked requirement, evidence artifact, and change trigger before making a public, customer-facing, audit, procurement, or internal control claim. - Define the monitoring scope and source-linked trigger before assigning the work. - Create evidence that proves the monitoring decision for the specific product, service, supplier, control, certificate profile, or implementation context. - Set a change trigger so the answer is reviewed after material source, product, supplier, platform, audit, or process changes. Sources for this answer: - [NIST SP 800-161 Rev. 1 Update 1 C-SCRM](https://doi.org/10.6028/NIST.SP.800-161r1-upd1?ref=sorena.io) - Primary NIST source for monitoring supplier risk, assigning C-SCRM ownership, collecting evidence, and reassessing changes over time. - [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach. - [NIST SP 800-53 Rev. 5 Controls](https://doi.org/10.6028/NIST.SP.800-53r5?ref=sorena.io) - Primary NIST source for the integrated security and privacy control catalog. ### [What evidence should support monitoring under NIST SP 800-161 Rev. 1?](/artifacts/global/nist-sp-800-161-rev-1/faq/monitoring.md#what-evidence-should-support-monitoring-under-nist-sp-800-161-rev-1) *Module: [How should teams handle monitoring under NIST SP 800-161 Rev. 1 supply-chain risk management?](/artifacts/global/nist-sp-800-161-rev-1/faq/monitoring.md)* Use NIST SP 800-161 Rev. 1 monitoring criteria to translate monitoring into an implementation workflow: define the decision, attach evidence, assign ownership, document gaps, and set a reassessment trigger. - Write the decision and scope in one sentence. - Attach the source-linked evidence that proves the current state. - Name the accountable owner and backup reviewer. - Record unresolved gaps, accepted risk, and dependencies. - Set a date or event trigger for reassessment. Sources for this answer: - [NIST SP 800-161 Rev. 1 Update 1 C-SCRM](https://doi.org/10.6028/NIST.SP.800-161r1-upd1?ref=sorena.io) - Primary NIST source for monitoring supplier risk, assigning C-SCRM ownership, collecting evidence, and reassessing changes over time. - [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach. - [NIST SP 800-53 Rev. 5 Controls](https://doi.org/10.6028/NIST.SP.800-53r5?ref=sorena.io) - Primary NIST source for the integrated security and privacy control catalog. ### [Provenance decision framework](/artifacts/global/nist-sp-800-161-rev-1/faq/provenance.md#provenance-decision-framework) *Module: [How should teams handle provenance under NIST SP 800-161 Rev. 1 supply-chain risk management?](/artifacts/global/nist-sp-800-161-rev-1/faq/provenance.md)* Handle provenance by defining the exact scope, owner, source-linked requirement, evidence artifact, and change trigger before making a public, customer-facing, audit, procurement, or internal control claim. - Define the provenance scope and source-linked trigger before assigning the work. - Create evidence that proves the provenance decision for the specific product, service, supplier, control, certificate profile, or implementation context. - Set a change trigger so the answer is reviewed after material source, product, supplier, platform, audit, or process changes. Sources for this answer: - [NIST SP 800-161 Rev. 1 Update 1 C-SCRM](https://doi.org/10.6028/NIST.SP.800-161r1-upd1?ref=sorena.io) - Primary NIST source for cybersecurity supply chain risk management practices. - [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach. - [NIST SP 800-53 Rev. 5 Controls](https://doi.org/10.6028/NIST.SP.800-53r5?ref=sorena.io) - Primary NIST source for the integrated security and privacy control catalog. ### [What evidence should support provenance under NIST SP 800-161 Rev. 1?](/artifacts/global/nist-sp-800-161-rev-1/faq/provenance.md#what-evidence-should-support-provenance-under-nist-sp-800-161-rev-1) *Module: [How should teams handle provenance under NIST SP 800-161 Rev. 1 supply-chain risk management?](/artifacts/global/nist-sp-800-161-rev-1/faq/provenance.md)* Keep the evidence practical and reviewable. A reader should be able to identify who owns the decision, which source supports it, what artifact proves it, and when it needs to be revisited. - Write the decision and scope in one sentence. - Attach the source-linked evidence that proves the current state. - Name the accountable owner and backup reviewer. - Record unresolved gaps, accepted risk, and dependencies. - Set a date or event trigger for reassessment. Sources for this answer: - [NIST SP 800-161 Rev. 1 Update 1 C-SCRM](https://doi.org/10.6028/NIST.SP.800-161r1-upd1?ref=sorena.io) - Primary NIST source for cybersecurity supply chain risk management practices. - [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach. - [NIST SP 800-53 Rev. 5 Controls](https://doi.org/10.6028/NIST.SP.800-53r5?ref=sorena.io) - Primary NIST source for the integrated security and privacy control catalog. ### [How should teams handle supplier incidents under NIST SP 800-161 Rev. 1 supply-chain risk management?](/artifacts/global/nist-sp-800-161-rev-1/faq/supplier-incidents.md#how-should-teams-handle-supplier-incidents-under-nist-sp-800-161-rev-1-supply-chain-risk-management) *Module: [How should teams handle supplier incidents under NIST SP 800-161 Rev. 1 supply-chain risk management?](/artifacts/global/nist-sp-800-161-rev-1/faq/supplier-incidents.md)* Handle supplier incidents by activating incident response and supply chain risk management together. NIST SP 800-161 Rev. 1 says supply chain compromises can span suppliers, developers, system integrators, external system service providers, and other third parties, and it requires organizations to define how incidents will be reported, shared, coordinated, and recovered under policy and contract terms. - Declare the event an incident when it meets your incident criteria and assign an incident lead. - Notify the supplier, relevant internal owners, and other third parties according to your response plan and contract terms. - Preserve incident data and metadata, including logs, tickets, reports, and chain-of-custody records when needed. - Contain and eradicate the issue, then verify restoration before returning to normal operations. - Record the root cause, impacted assets, and any supplier obligations that need follow-up or reassessment. - Update supplier risk assessments, contracts, and contingency plans if the incident changes the risk profile. Sources for this answer: - [NIST SP 800-161 Rev. 1 Update 1 C-SCRM](https://doi.org/10.6028/NIST.SP.800-161r1-upd1?ref=sorena.io) - Primary NIST C-SCRM source for supplier-incident escalation, evidence, ownership, response coordination, and reassessment expectations. - [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach. - [NIST SP 800-53 Rev. 5 Controls](https://doi.org/10.6028/NIST.SP.800-53r5?ref=sorena.io) - Primary NIST source for the integrated security and privacy control catalog. ### [What evidence should support supplier incidents under NIST SP 800-161 Rev. 1?](/artifacts/global/nist-sp-800-161-rev-1/faq/supplier-incidents.md#what-evidence-should-support-supplier-incidents-under-nist-sp-800-161-rev-1) *Module: [How should teams handle supplier incidents under NIST SP 800-161 Rev. 1 supply-chain risk management?](/artifacts/global/nist-sp-800-161-rev-1/faq/supplier-incidents.md)* Use the evidence your incident response plan expects, and make sure it is enough to support the containment and recovery decisions you make. NIST SP 800-61r3 emphasizes that incident handlers collect and analyze data and evidence, and that incident data and metadata should be preserved with integrity and provenance. For supplier incidents, that usually means logs, alert records, affected versions, ticket history, communication records, and any supplier notices or disclosures tied to the event. - Write the incident scope in one sentence, including the supplier, product, or service involved. - Keep the records needed to preserve incident data and metadata, including provenance and chain of custody when appropriate. - Name the accountable owner for containment, recovery, supplier communication, and follow-up reassessment. - Record unresolved gaps, accepted risk, and dependencies that could affect business continuity or future incidents. - Set a date or event trigger for reassessment after the incident is closed or after any material supplier change. Sources for this answer: - [NIST SP 800-161 Rev. 1 Update 1 C-SCRM](https://doi.org/10.6028/NIST.SP.800-161r1-upd1?ref=sorena.io) - Primary NIST C-SCRM source for supplier-incident escalation, evidence, ownership, response coordination, and reassessment expectations. - [NIST SP 800-61r3 Incident Response Recommendations and Considerations for Cybersecurity Risk Management](https://doi.org/10.6028/NIST.SP.800-61r3?ref=sorena.io) - Primary NIST incident-response source for incident handling, evidence preservation, communication, containment, and recovery. - [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach. ### [How should teams handle supply chain risk response under NIST SP 800-161 Rev. 1 supply-chain risk management?](/artifacts/global/nist-sp-800-161-rev-1/faq/supply-chain-risk-response.md#how-should-teams-handle-supply-chain-risk-response-under-nist-sp-800-161-rev-1-supply-chain-risk-management) *Module: [How should teams handle supply chain risk response under NIST SP 800-161 Rev. 1 supply-chain risk management?](/artifacts/global/nist-sp-800-161-rev-1/faq/supply-chain-risk-response.md)* Handle supply chain risk response by defining the exact scope, owner, source-linked requirement, evidence artifact, and change trigger before making a public, customer-facing, audit, procurement, or internal control claim. - Define the supply chain risk response scope and source-linked trigger before assigning the work. - Create evidence that proves the supply chain risk response decision for the specific product, service, supplier, control, certificate profile, or implementation context. - Set a change trigger so the answer is reviewed after material source, product, supplier, platform, audit, or process changes. Sources for this answer: - [NIST SP 800-161 Rev. 1 Update 1 C-SCRM](https://doi.org/10.6028/NIST.SP.800-161r1-upd1?ref=sorena.io) - Primary NIST source for cybersecurity supply chain risk management practices. - [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach. - [NIST SP 800-53 Rev. 5 Controls](https://doi.org/10.6028/NIST.SP.800-53r5?ref=sorena.io) - Primary NIST source for the integrated security and privacy control catalog. ### [What evidence should support supply chain risk response under NIST SP 800-161 Rev. 1?](/artifacts/global/nist-sp-800-161-rev-1/faq/supply-chain-risk-response.md#what-evidence-should-support-supply-chain-risk-response-under-nist-sp-800-161-rev-1) *Module: [How should teams handle supply chain risk response under NIST SP 800-161 Rev. 1 supply-chain risk management?](/artifacts/global/nist-sp-800-161-rev-1/faq/supply-chain-risk-response.md)* Keep the evidence practical and reviewable. A reader should be able to identify who owns the decision, which source supports it, what artifact proves it, and when it needs to be revisited. - Write the decision and scope in one sentence. - Attach the source-linked evidence that proves the current state. - Name the accountable owner and backup reviewer. - Record unresolved gaps, accepted risk, and dependencies. - Set a date or event trigger for reassessment. Sources for this answer: - [NIST SP 800-161 Rev. 1 Update 1 C-SCRM](https://doi.org/10.6028/NIST.SP.800-161r1-upd1?ref=sorena.io) - Primary NIST source for cybersecurity supply chain risk management practices. - [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach. - [NIST SP 800-53 Rev. 5 Controls](https://doi.org/10.6028/NIST.SP.800-53r5?ref=sorena.io) - Primary NIST source for the integrated security and privacy control catalog. ### [When should supply chain risk response be reviewed again?](/artifacts/global/nist-sp-800-161-rev-1/faq/supply-chain-risk-response.md#when-should-supply-chain-risk-response-be-reviewed-again) *Module: [How should teams handle supply chain risk response under NIST SP 800-161 Rev. 1 supply-chain risk management?](/artifacts/global/nist-sp-800-161-rev-1/faq/supply-chain-risk-response.md)* Review the response again after material source, product, supplier, service, platform, audit, procurement, or process changes. NIST SP 800-161 Rev. 1 says C-SCRM activities should be monitored on an ongoing basis and that changes to the information system or supply chain should be tracked through a feedback loop for continuous improvement. - Use a change trigger, not a fixed one-time approval. - Recheck the decision after contract, supplier, or system changes. - Update the response when incident or vulnerability information changes the risk picture. - Keep the response tied to the current operating context, not only the original assessment. Sources for this answer: - [NIST SP 800-161 Rev. 1 Update 1 C-SCRM](https://doi.org/10.6028/NIST.SP.800-161r1-upd1?ref=sorena.io) - NIST source for incident and information sharing guidance. ### [What should teams document before making a tiering decision?](/artifacts/global/nist-sp-800-161-rev-1/faq/tiering.md#what-should-teams-document-before-making-a-tiering-decision) *Module: [How should teams handle tiering under NIST SP 800-161 Rev. 1 supply-chain risk management?](/artifacts/global/nist-sp-800-161-rev-1/faq/tiering.md)* Handle tiering by defining the exact scope, owner, source-linked requirement, evidence artifact, and change trigger before making a public, customer-facing, audit, procurement, or internal control claim. - Define the tiering scope and source-linked trigger before assigning the work. - Create evidence that proves the tiering decision for the specific product, service, supplier, control, certificate profile, or implementation context. - Set a change trigger so the answer is reviewed after material source, product, supplier, platform, audit, or process changes. Sources for this answer: - [NIST SP 800-161 Rev. 1 Update 1 C-SCRM](https://doi.org/10.6028/NIST.SP.800-161r1-upd1?ref=sorena.io) - Primary NIST source for cybersecurity supply chain risk management practices. - [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach. - [NIST SP 800-53 Rev. 5 Controls](https://doi.org/10.6028/NIST.SP.800-53r5?ref=sorena.io) - Primary NIST source for the integrated security and privacy control catalog. ### [What evidence should support tiering under NIST SP 800-161 Rev. 1?](/artifacts/global/nist-sp-800-161-rev-1/faq/tiering.md#what-evidence-should-support-tiering-under-nist-sp-800-161-rev-1) *Module: [How should teams handle tiering under NIST SP 800-161 Rev. 1 supply-chain risk management?](/artifacts/global/nist-sp-800-161-rev-1/faq/tiering.md)* Use NIST SP 800-161 Rev. 1 tiering criteria to turn tiering decisions into implementation-ready workflow: define organizational and mission context, attach evidence, assign ownership, document gaps, and set a reassessment trigger. - Write the decision and scope in one sentence. - Attach the source-linked evidence that proves the current state. - Name the accountable owner and backup reviewer. - Record unresolved gaps, accepted risk, and dependencies. - Set a date or event trigger for reassessment. Sources for this answer: - [NIST SP 800-161 Rev. 1 Update 1 C-SCRM](https://doi.org/10.6028/NIST.SP.800-161r1-upd1?ref=sorena.io) - Primary NIST source for cybersecurity supply chain risk management practices. - [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach. - [NIST SP 800-53 Rev. 5 Controls](https://doi.org/10.6028/NIST.SP.800-53r5?ref=sorena.io) - Primary NIST source for the integrated security and privacy control catalog. ### [What contract controls should teams include in supplier agreements?](/artifacts/global/nist-sp-800-161-rev-1/faq/contract-controls.md#what-contract-controls-should-teams-include-in-supplier-agreements) *Module: [Which contract controls should teams define under NIST SP 800-161 Rev. 1?](/artifacts/global/nist-sp-800-161-rev-1/faq/contract-controls.md)* NIST SP 800-161 Rev. 1 says supplier contracts and agreements should include the security requirements, flow-down requirements, monitoring terms, and incident or disruption response terms needed to manage supply chain risk. - Access control and account management for contractor personnel (AC-1, AC-2, AC-3, AC-17, AC-20, AC-21, AC-24). - Training and awareness for contractor staff who touch the supply chain (AT-1, AT-2, AT-3). - Audit, logging, and accountability requirements for supply chain events (AU-1, AU-2, AU-6, AU-12, AU-16). - Assessment, authorization, monitoring, and remediation requirements for supplier risk and control reviews (CA-2, CA-5, CA-6, CA-7). - Configuration management, component inventory, and signed-component expectations (CM-2, CM-3, CM-8, CM-9, CM-14). - Contingency planning, testing, and critical-supplier participation in recovery activities (CP-2, CP-3, CP-4, CP-8, CP-11). - Incident-response terms for reporting vulnerabilities, incidents, and other business disruptions (IR-1 and related communication terms). Sources for this answer: - [NIST SP 800-161 Rev. 1 Update 1 C-SCRM](https://doi.org/10.6028/NIST.SP.800-161r1-upd1?ref=sorena.io) - Primary NIST C-SCRM source for acquisition criteria and supplier agreement expectations. ### [What evidence should support contract controls under NIST SP 800-161 Rev. 1?](/artifacts/global/nist-sp-800-161-rev-1/faq/contract-controls.md#what-evidence-should-support-contract-controls-under-nist-sp-800-161-rev-1) *Module: [Which contract controls should teams define under NIST SP 800-161 Rev. 1?](/artifacts/global/nist-sp-800-161-rev-1/faq/contract-controls.md)* Use NIST SP 800-161 Rev. 1 contract-control criteria to translate contract requirements into an implementation workflow: define the decision, attach evidence, assign ownership, document gaps, and set a reassessment trigger. - Write the decision and scope in one sentence. - Attach the source-linked evidence that proves the current state. - Name the accountable owner and backup reviewer. - Record unresolved gaps, accepted risk, and dependencies. - Set a date or event trigger for reassessment. Sources for this answer: - [NIST SP 800-161 Rev. 1 Update 1 C-SCRM](https://doi.org/10.6028/NIST.SP.800-161r1-upd1?ref=sorena.io) - Primary NIST C-SCRM source for defining supplier contract controls, evidence requests, review triggers, and escalation paths by supplier criticality. - [NIST CSF 2.0 (CSWP 29)](https://doi.org/10.6028/NIST.CSWP.29?ref=sorena.io) - Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach. - [NIST SP 800-53 Rev. 5 Controls](https://doi.org/10.6028/NIST.SP.800-53r5?ref=sorena.io) - Primary NIST source for the integrated security and privacy control catalog. *Recommended next step* *Placement: after the practical workflow* ## Put this NIST SP 800-161 Rev. 1 C-SCRM guidance into practice Use the cited sources to turn the guidance into scoped decisions, owners, evidence requests, and review checkpoints. - [Open Assessment Autopilot for NIST SP 800-161 Rev. 1 C-SCRM](/solutions/assessment.md): Create source-linked tasks, evidence requests, and review checkpoints for this NIST SP 800-161 Rev. 1 C-SCRM scope. - [Review this NIST SP 800-161 Rev. 1 C-SCRM scope with Sorena](/contact.md): Check source coverage, ownership, evidence gaps, and next steps before publishing or operationalizing the work. --- [Privacy Policy](https://www.sorena.io/privacy) | [Terms of Use](https://www.sorena.io/terms-of-use) | [DMCA](https://www.sorena.io/dmca) | [About Us](https://www.sorena.io/about-us) (c) 2026 Sorena AB (559573-7338). All rights reserved. Source: https://www.sorena.io/artifacts/global/nist-sp-800-161-rev-1/faq/items