We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

FAQGLOBALNIST SP 800-161 Rev. 1

NIST SP 800-161 Rev. 1 Supplier incidents

Validate the report, scope customer exposure, assign an incident lead, and coordinate containment and recovery with the supplier.

Preserve records and verify restoration. Notification recipients and deadlines come from applicable law, policy, and contract.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Oct 15, 2026
3 sections3 primary sources
Overview

Handle a through the organization's incident-response process and its C-SCRM process at the same time. Validate and prioritize the report, assign an incident lead, coordinate with the supplier under established plans and agreements, preserve incident records, contain and eradicate the incident, restore affected services, and reassess the supplier and dependency. NIST SP 800-161 Rev. 1 Update 1 and NIST SP 800-61 Rev. 3 are guidance. Notification duties and deadlines come from applicable law, regulation, policy, and contract, not from one universal NIST deadline.

Search this module

Find a question or answer quickly

3 of 3 questions
Question 1

How should teams handle supplier incidents under NIST SP 800-161 Rev. 1 supply-chain risk management?

NIST SP 800-161 Rev. 1 Update 1 says contracts and contract management should define vulnerability, incident, and business-disruption reporting and the parties' roles in response, corrective action, and recovery. Its SR-8 guidance also addresses within the supply chain for critical products or services.

NIST SP 800-61 Rev. 3 supplies the incident-response structure: reports are validated, categorized, prioritized, and escalated; investigations establish what happened and preserve records; response activities are coordinated with internal and external stakeholders; incidents are contained and eradicated; and recovery is verified before normal operation is confirmed.

The organization remains responsible for its own decision. A supplier's statement that an incident is contained does not establish the scope or safety of the customer's environment. Determine which product versions, services, credentials, data, systems, customers, and sub-tier providers are affected, then decide what independent validation is needed. If the report remains unconfirmed, preserve that uncertainty, apply proportionate interim controls, and set the next decision time instead of treating silence as closure.

  • Validate and scope: confirm the event, supplier relationship, affected products or services and versions, customer exposure, severity, urgency, and known uncertainty.
  • Coordinate: assign an incident lead and owners for supplier communication, legal and regulatory review, business continuity, technical response, and executive decisions.
  • Notify and share: follow the current legal, regulatory, policy, contractual, and information-sharing rules for content, recipient, channel, timing, and updates.
  • Preserve and analyze: retain incident data, metadata, supplier notices, logs, tickets, images, versions, decisions, and investigation actions with integrity, provenance, and when appropriate.
  • Contain, eradicate, and recover: isolate or suspend affected connections or components as authorized, remove persistence and exploited weaknesses, verify restoration assets, and confirm recovery criteria before normal operation.
  • Follow through: document root cause and lessons, track supplier corrective action, reassess criticality and residual risk, and update contracts, monitoring, architecture, inventories, and contingency plans when needed.
Question 2

What evidence should support supplier incidents under NIST SP 800-161 Rev. 1?

Use the evidence-preservation procedures and retention rules in the incident-response plan. NIST SP 800-61 Rev. 3 says incident data and metadata should be collected with their integrity and provenance preserved, while recognizing that formal chain-of-custody handling may not be necessary for every incident.

For a , preserve enough evidence to support scope, containment, notification, recovery, and follow-up decisions. Record what the supplier reported, what the organization independently observed, where the accounts differ, what remains unknown, and who accepted any decision made with incomplete information.

  • Scope record: supplier, relationship, product or service and version, affected assets and data, time window, indicators, severity, assumptions, and unresolved questions.
  • Evidence record: original supplier notices, logs, tickets, images, alerts, decisions, investigation actions, access controls, retention, integrity checks, and when appropriate.
  • Action record: containment, eradication, recovery, notification, communication, owner, authorization, time, result, and reversal or exit criteria.
  • Closure record: verified restoration, root cause, residual risk, supplier corrective action, contract follow-up, lessons, reassessment owner, and scheduled or event-driven review.
Recommended next step

Put this NIST SP 800-161 Rev. 1 C-SCRM guidance into practice

Connect supplier reporting agreements to incident scope, response owners, evidence preservation, notification, and verified recovery.

Assessment workflow
Open Assessment Autopilot for NIST SP 800-161 Rev. 1 C-SCRM

Create cited tasks, evidence requests, and review checkpoints for this NIST SP 800-161 Rev. 1 C-SCRM scope.

Explore next step
Talk to Sorena
Review this NIST SP 800-161 Rev. 1 C-SCRM scope with Sorena

Review supplier incident roles, reporting duties, containment decisions, recovery criteria, and corrective-action follow-up.

Explore next step
Question 3

Questions and answers

What is the first action after a supplier reports a possible incident?

Route the report into the organization's incident-response and C-SCRM processes, preserve the original notice, validate the event, and establish scope, severity, urgency, uncertainty, and an incident lead. Identify affected products or services and versions, systems, credentials, data, customers, and sub-tier providers. Apply authorized interim containment when delay could increase harm, but keep observed facts separate from unverified supplier statements.

Does NIST set one supplier-incident notification deadline?

No. NIST recommends defined reporting and , roles, channels, corrective action, and recovery coordination. The binding recipient, content, and deadline depend on applicable law, regulation, policy, and contract. Teams should identify those obligations before an incident, record when each trigger was met, and preserve each notice and update.

When can a be closed?

Close it only after authorized completion criteria are met: affected scope is documented, containment and eradication are complete, restoration is verified, required notifications and communications are recorded, remaining uncertainty and residual risk have an owner, and supplier corrective action and reassessment have clear follow-up. A supplier's closure notice alone does not prove the customer's environment is safe.

Primary sources

References and citations

NIST SP 800-161 Rev. 1 Update 1 C-SCRM
doi.org3 citations
Referenced sections
  • Primary C-SCRM source for supplier incident and business-disruption reporting, notification agreements, contractual response roles, corrective action, and recovery.
  • Section 3.1.2 covers contractual reporting and response roles for vulnerabilities, incidents, and business disruptions; Appendix A includes notification agreements and incident-response control guidance.
  • Section 3.1.2 and Appendix A support supplier reporting, notification agreements, response roles, corrective action, recovery, and contract coordination for supply-chain incidents.
"vulnerabilities, incidents, and other business disruptions"
NIST SP 800-61 Rev. 3 Incident Response Recommendations
doi.org2 citations
Referenced sections
  • Current NIST incident-response guidance, published in April 2025, for preparing, detecting, responding, recovering, preserving evidence, and coordinating with internal and external parties.
  • The Respond and Recover profile covers validation, prioritization, escalation, investigation, coordination, notification, containment, eradication, restoration, and completion criteria.
"Incident data and metadata are collected, and their integrity and provenance are preserved"
More quoted passages
"Detect, Respond, and Recover help organizations discover, manage, prioritize, contain, eradicate, and recover from cybersecurity incidents"

Related guides

How should teams handle counterfeits under NIST SP 800-161 Rev. 1 supply-chain risk management?

Prioritize critical items, use traceable sources, verify authenticity and tamper protection, quarantine suspected counterfeits, and reassess affected risk.

How should teams handle critical suppliers under NIST SP 800-161 Rev. 1 supply-chain risk management?

Identify critical suppliers through mission dependency, component importance, access, concentration, substitutability, and potential impact, not spend alone.

How should teams handle monitoring under NIST SP 800-161 Rev. 1 supply-chain risk management?

Run risk-based supplier monitoring with scheduled revalidation, event triggers, operating signals, escalation thresholds, corrective action, and evidence.

How should teams handle provenance under NIST SP 800-161 Rev. 1 supply-chain risk management?

Collect and verify traceable origin, build, dependency, custody, authenticity, and change evidence for critical systems, components, software, and data.

How should teams handle supply chain risk response under NIST SP 800-161 Rev. 1 supply-chain risk management?

Choose and document whether to accept, avoid, mitigate, share, or transfer supply-chain risk, with authority, actions, residual risk, and review triggers.

How should teams handle tiering under NIST SP 800-161 Rev. 1 supply-chain risk management?

Build supplier risk categories that drive assurance treatment while keeping them distinct from SP 800-161 risk-management levels and CSF Tiers.

Show all related guides (19)

Which contract controls should teams define under NIST SP 800-161 Rev. 1?

Translate supplier risk into measurable security, flow-down, evidence, monitoring, incident, continuity, remediation, and exit clauses under SP 800-161.

NIST SP 800-161 Rev. 1 C-SCRM Governance Checklist

A NIST SP 800-161 Rev. 1 checklist for assigning C-SCRM decisions across enterprise, mission/business-process, and operational levels.

NIST SP 800-161 Rev. 1 C-SCRM Governance Guide

Design NIST SP 800-161 Rev. 1 C-SCRM governance across the enterprise, mission/business-process, and operational levels with accountable roles and feedback loops.

NIST SP 800-161 Rev. 1 Contract and Monitoring Controls

Translate C-SCRM risk decisions into supplier clauses, subcontractor flow-down, evidence delivery, revalidation, monitoring, incident, continuity, and exit terms.

NIST SP 800-161 Rev. 1 Criticality Analysis Guide

Identify mission-critical functions, systems, components, products, services, suppliers, and single-source dependencies so C-SCRM effort follows potential impact.

NIST SP 800-161 Rev. 1 FAQ: practical implementation questions

NIST SP 800-161 Rev. 1 answers with cited implementation steps, decision criteria, and evidence guidance.

NIST SP 800-161 Rev. 1 implementation playbook

Build a tailored C-SCRM program with strategy, policy, plans, assessments, acquisition controls, monitoring, and evidence across NIST's three risk-management levels.

NIST SP 800-161 Rev. 1 Provenance and SBOM Supplier Controls

Use provenance, SBOM, build integrity, authenticity, and supplier evidence together to manage software and component risk under NIST SP 800-161 Rev. 1.

NIST SP 800-161 Rev. 1 supplier assessment evidence: risk-based records and evaluation criteria

Choose and validate supplier evidence based on criticality, risk, contract requirements, source reliability, freshness, and proof of operating effectiveness.

NIST SP 800-161 Rev. 1 Supplier Risk Tiering

Group suppliers by mission dependency and cyber risk, then tie each category to proportionate due diligence, evidence, contracts, monitoring, and response.

NIST SP 800-161 Rev. 1 vs DORA ICT third-party risk: practical side-by-side comparison

Compare NIST SP 800-161 Rev. 1 and DORA ICT third-party risk with side-by-side scope, owner, trigger, evidence, cadence, assurance, and decision-rule rows.

NIST SP 800-161 Rev. 1 vs ISO/IEC 27036 supplier relationships: practical side-by-side comparison

Compare NIST SP 800-161 Rev. 1 and ISO/IEC 27036 supplier relationships with side-by-side scope, owner, trigger, evidence, cadence, assurance, and decision-rule rows.

NIST SP 800-161 Rev. 1: workflow for collecting and validating C-SCRM supplier evidence

A risk-based NIST SP 800-161 supplier evidence workflow from relationship scope and criticality through request, validation, decision, remediation, and monitoring.