We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

FAQGLOBALNIST SP 800-161 Rev. 1

NIST SP 800-161 Rev. 1 Supply-chain risk response

Compare acceptance, avoidance, mitigation, sharing, and transfer against the assessed risk and the decision-maker's authority.

Record the selected response, funded actions, owners, , monitoring signals, and conditions for escalation or review.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Oct 15, 2026
4 sections1 primary sources
Overview

Choose a only after stating a specific supply-chain risk and comparing the available courses of action. NIST SP 800-161 Rev. 1 Update 1 lists accept, avoid, mitigate, share, and transfer as possible responses. The record should name the authorized decision-maker, selected action, resources, dependencies, expected effect, , monitoring signals, and conditions for escalation or review. NIST supplies guidance; law, policy, contract, and delegated authority may narrow the available choice.

Search this module

Find a question or answer quickly

4 of 4 questions
Question 1

How should teams handle supply chain risk response under NIST SP 800-161 Rev. 1 supply-chain risk management?

Begin with a risk scenario that connects a threat event, vulnerability or exposure, affected supplier, product, service, or supply-chain path, likelihood, and impact. State the time horizon and assumptions. Consider criticality, concentration, substitutability, dependencies, recovery or replacement time, and effects on missions, systems, data, people, other organizations, and the Nation where relevant.

Compare responses against risk appetite and , mission priorities, applicable law and contracts, cost, feasibility, dependencies, and decision authority. Acceptance keeps the identified exposure without further risk-reducing action because the authorized owner judges the remaining risk acceptable. Avoidance removes the activity or exposure. Mitigation changes likelihood or impact through controls. Sharing or transfer reallocates some responsibility or financial consequence through arrangements such as contracts or insurance, but it does not automatically remove operational, mission, legal, or reputational exposure.

Mitigation can include alternate sources, contract changes, added inspection or testing, segmentation, reduced access, patching, inventory buffers, recovery measures, or increased monitoring. State which part of the scenario each action changes and how effectiveness will be measured. Listing controls without that connection does not explain the response.

  • Confirm that the risk statement and assessment are specific enough for a decision and identify uncertainty that could change the result.
  • Document alternatives considered, the selected course, the authority making the decision, and why the is within that authority's tolerance.
  • Translate the response into funded acquisition, contract, engineering, security, monitoring, and contingency actions with owners, milestones, dependencies, and measures.
  • Escalate risk above tolerance, outside the owner's authority, or aggregated across several systems or missions to the appropriate mission/business or enterprise authority.
Question 2

What evidence should support supply chain risk response under NIST SP 800-161 Rev. 1?

The record should preserve the assessed scenario, source information, assumptions, alternatives, selected response, decision authority, , funded actions, dependencies, effectiveness measures, and current status. Link it to the relevant C-SCRM plan, risk register, system plan, supplier assessment, contract, contingency plan, incident record, or plan of action and milestones (POA&M).

  • Risk scenario, scope, likelihood, impact, criticality, assumptions, and source information.
  • Response options considered, expected effect on likelihood or impact, selected action, accountable authority, , rationale, and approval date.
  • Action owners, funding and other resources, milestones, dependencies, measures, monitoring signals, escalation threshold, completion evidence, and review triggers.
Recommended next step

Put the selected supply-chain risk response into action

Record the selected response, decision authority, residual risk, funded actions, and monitoring and escalation conditions.

Assessment workflow
Open Assessment Autopilot for NIST SP 800-161 Rev. 1 C-SCRM

Create cited tasks, evidence requests, and review checkpoints for this NIST SP 800-161 Rev. 1 C-SCRM scope.

Explore next step
Talk to Sorena
Review this NIST SP 800-161 Rev. 1 C-SCRM scope with Sorena

Review response alternatives, risk acceptance authority, action ownership, and the evidence needed to reassess the decision.

Explore next step
Question 3

When should supply chain risk response be reviewed again?

Review the response at the planned interval and when a material change could alter likelihood, impact, effectiveness, or decision authority. NIST's Monitor step calls for organization-set review intervals and documented off-cycle triggers, not one universal cadence.

Triggers can include new threat or vulnerability information, an incident, failed control, stale evidence, supplier or product change, ownership change, loss of an alternative source, contract change, changed mission or architecture, audit finding, natural disaster, or resource change. Update the assessment and response rather than recording the trigger without a new decision.

  • Use both a scheduled review and documented off-cycle triggers.
  • Recheck the scenario, alternatives, control effectiveness, , and authority after a trigger.
  • Close or replace the response only when completion evidence supports the decision and ongoing monitoring has an owner.
  • Preserve the history so reviewers can see why the response changed.
Question 4

Questions and answers

What is the basic NIST response model for supply chain risk?

NIST uses four connected steps: frame, assess, respond, and monitor. In the Respond step, compare alternative courses of action and select acceptance, avoidance, mitigation, sharing, transfer, or a combination that fits the assessed risk and decision authority. Document the decision in the relevant C-SCRM plan, risk record, or plan of action and milestones (POA&M), then monitor whether the response works and whether conditions change.

Who should own supply chain decisions?

NIST says ownership and accountability for cybersecurity risks in the supply chain ultimately lie with the head of the organization. Responsibilities can be assigned across Level 1 enterprise, Level 2 mission/business, and Level 3 operational roles, but a response must reach the authority whose and delegated power cover the . Escalate decisions above that tolerance or outside that delegation.

What should trigger a new review of a supply chain ?

Review at the organization-set interval and after an off-cycle trigger that could change likelihood, impact, response effectiveness, or authority. Examples include a new threat or vulnerability, incident, failed control, supplier or product change, ownership change, loss of an alternative source, contract or architecture change, natural disaster, or resource change. Reassess the scenario and record a new decision when the trigger matters.

Does transferring supply-chain risk remove the organization's responsibility?

No. A contract, indemnity, service agreement, or insurance policy can allocate duties or financial consequences, but the organization still identifies and monitors the operational, mission, legal, security, and reputational exposure that remains. Record what was transferred or shared, what was not, the counterparty's ability to perform, and the accepted by the authorized owner.

Primary sources

References and citations

NIST SP 800-161 Rev. 1 Update 1 C-SCRM
doi.org4 citations
Referenced sections
  • Section 2.3 and Appendix G ground the accept, avoid, mitigate, share, or transfer options, decision authority across three levels, documented response actions, monitoring, and reassessment.
  • Section 2.3.4 and Appendix G's Respond step cover alternative courses of action, risk response across all three levels, tailored controls, acceptable risk, and documented C-SCRM plans and POA&Ms.
  • Appendix G requires decision-makers to receive assessment results, mitigation options, and acceptable-risk information and describes response outputs in C-SCRM plans and POA&Ms.
Show 1 more
  • Primary NIST source for ongoing C-SCRM monitoring, response, and control selection.
"accept, avoid, mitigate, share, and/or transfer"
More quoted passages
"Identify alternative courses of action to respond to risks identified during the risk assessment."
"assess, respond to, and monitor cybersecurity risks throughout the supply chain"

Related guides

How should teams handle counterfeits under NIST SP 800-161 Rev. 1 supply-chain risk management?

Prioritize critical items, use traceable sources, verify authenticity and tamper protection, quarantine suspected counterfeits, and reassess affected risk.

How should teams handle critical suppliers under NIST SP 800-161 Rev. 1 supply-chain risk management?

Identify critical suppliers through mission dependency, component importance, access, concentration, substitutability, and potential impact, not spend alone.

How should teams handle monitoring under NIST SP 800-161 Rev. 1 supply-chain risk management?

Run risk-based supplier monitoring with scheduled revalidation, event triggers, operating signals, escalation thresholds, corrective action, and evidence.

How should teams handle provenance under NIST SP 800-161 Rev. 1 supply-chain risk management?

Collect and verify traceable origin, build, dependency, custody, authenticity, and change evidence for critical systems, components, software, and data.

How should teams handle supplier incidents under NIST SP 800-161 Rev. 1 supply-chain risk management?

Coordinate supplier incidents through joint triage, evidence preservation, containment, recovery, contract communication, corrective action, and reassessment.

How should teams handle tiering under NIST SP 800-161 Rev. 1 supply-chain risk management?

Build supplier risk categories that drive assurance treatment while keeping them distinct from SP 800-161 risk-management levels and CSF Tiers.

Show all related guides (19)

Which contract controls should teams define under NIST SP 800-161 Rev. 1?

Translate supplier risk into measurable security, flow-down, evidence, monitoring, incident, continuity, remediation, and exit clauses under SP 800-161.

NIST SP 800-161 Rev. 1 C-SCRM Governance Checklist

A NIST SP 800-161 Rev. 1 checklist for assigning C-SCRM decisions across enterprise, mission/business-process, and operational levels.

NIST SP 800-161 Rev. 1 C-SCRM Governance Guide

Design NIST SP 800-161 Rev. 1 C-SCRM governance across the enterprise, mission/business-process, and operational levels with accountable roles and feedback loops.

NIST SP 800-161 Rev. 1 Contract and Monitoring Controls

Translate C-SCRM risk decisions into supplier clauses, subcontractor flow-down, evidence delivery, revalidation, monitoring, incident, continuity, and exit terms.

NIST SP 800-161 Rev. 1 Criticality Analysis Guide

Identify mission-critical functions, systems, components, products, services, suppliers, and single-source dependencies so C-SCRM effort follows potential impact.

NIST SP 800-161 Rev. 1 FAQ: practical implementation questions

NIST SP 800-161 Rev. 1 answers with cited implementation steps, decision criteria, and evidence guidance.

NIST SP 800-161 Rev. 1 implementation playbook

Build a tailored C-SCRM program with strategy, policy, plans, assessments, acquisition controls, monitoring, and evidence across NIST's three risk-management levels.

NIST SP 800-161 Rev. 1 Provenance and SBOM Supplier Controls

Use provenance, SBOM, build integrity, authenticity, and supplier evidence together to manage software and component risk under NIST SP 800-161 Rev. 1.

NIST SP 800-161 Rev. 1 supplier assessment evidence: risk-based records and evaluation criteria

Choose and validate supplier evidence based on criticality, risk, contract requirements, source reliability, freshness, and proof of operating effectiveness.

NIST SP 800-161 Rev. 1 Supplier Risk Tiering

Group suppliers by mission dependency and cyber risk, then tie each category to proportionate due diligence, evidence, contracts, monitoring, and response.

NIST SP 800-161 Rev. 1 vs DORA ICT third-party risk: practical side-by-side comparison

Compare NIST SP 800-161 Rev. 1 and DORA ICT third-party risk with side-by-side scope, owner, trigger, evidence, cadence, assurance, and decision-rule rows.

NIST SP 800-161 Rev. 1 vs ISO/IEC 27036 supplier relationships: practical side-by-side comparison

Compare NIST SP 800-161 Rev. 1 and ISO/IEC 27036 supplier relationships with side-by-side scope, owner, trigger, evidence, cadence, assurance, and decision-rule rows.

NIST SP 800-161 Rev. 1: workflow for collecting and validating C-SCRM supplier evidence

A risk-based NIST SP 800-161 supplier evidence workflow from relationship scope and criticality through request, validation, decision, remediation, and monitoring.