Artifact GuideGLOBALNIST SP 800-161 Rev. 1

NIST SP 800-161 Rev. 1 Supplier Assessment Evidence Guide

Match supplier evidence to the relationship's criticality and assessed risk, then evaluate scope, provenance, freshness, exceptions, and operating effectiveness.

Match evidence to the decision, criticality, and exact supplier, product, service, location, system, and period. SP 800-161 does not define one required evidence package for every relationship.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

Jul 24, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated Jul 24, 2026

Overview

can include due-diligence research, questionnaires, policies and procedures, independent assessments or certifications, test results, vulnerability and incident records, provenance and software bill of materials (SBOM) data, contract performance, site visits, and technical verification. NIST SP 800-161 Rev. 1 was published in May 2022 and Update 1 includes changes through 1 November 2024. No single artifact proves that a supplier relationship is secure. Decide whether each item covers the exact supplier, product, service, location, sub-tier, system, control, and period in question, then record what uncertainty remains.

Section 1

Decisions supplier assessment evidence should support

Start from the risk question and the decision the evidence must support: source selection, contract award, acceptance, system authorization, continued use, remediation, renewal, or exit. NIST's cybersecurity supply chain risk management (C-SCRM) guidance says the rigor of validation and revalidation should match the criticality of the product or service and the required assurance.

Evaluate relevance, scope, provenance, source competence and independence, collection method, date and covered period, exceptions, corrective actions, and whether the artifact shows design or actual operation. Record conflicting or unavailable evidence as uncertainty in the risk decision rather than treating it as a pass.

For initial screening, use public and commercial research, requests for information, sources-sought notices, and due-diligence questionnaires where they fit the acquisition process. NIST warns that the initial due-diligence assessment is not exhaustive.
For requirement validation, consider supplier self-assessment, acquirer review, established third-party assessment, certification, site visit, test, telemetry, or operating record. An established assessment may be reused when its scope and method meet the enterprise's specific requirement.
For the risk decision, retain the evidence source, covered scope and period, information-quality and confidence judgment, findings, assumptions, constraints, impact, response, approver, and follow-up trigger.
Treat NIST SP 800-161 as guidance unless law, policy, regulation, or contract makes a specific practice binding for the organization.

Sources for this answer

NIST SP 800-161 Rev. 1 Update 1 C-SCRM

Section 3.1.2 and Appendix A explain due diligence, validation methods, reuse of existing assessments, additional evidence for uncovered requirements, protection of collected data, and risk-based rigor.

Recommended next step

Put this NIST SP 800-161 Rev. 1 C-SCRM guidance into practice

Use the cited sources to turn the guidance into scoped decisions, owners, evidence requests, and review checkpoints.

Assessment workflow

Open Assessment Autopilot for NIST SP 800-161 Rev. 1 C-SCRM

Create cited tasks, evidence requests, and review checkpoints for this NIST SP 800-161 Rev. 1 C-SCRM scope.

Explore next step

Talk to Sorena

Review this NIST SP 800-161 Rev. 1 C-SCRM scope with Sorena

Check source coverage, ownership, evidence gaps, and next steps before publishing or operationalizing the work.

Explore next step

Section 2

How to scope supplier questionnaire, proof, and monitoring evidence without overclaiming

Start with the narrowest useful scope. A parent-company certificate may not cover the contracted legal entity, and a platform report may omit the selected service, region, subprocessor, release, or customer-responsibility control. Read the scope statement, assessment period, exclusions, qualifications, and complementary customer controls before relying on it.

Separate design evidence from operation evidence. A policy or procedure can show intended design; an assessment report can show what an assessor tested within a stated scope and period; test results and operating records can show a condition or activity at a point in time. None establishes conditions outside its scope.

Identify the supplier legal entity, product or service, version, delivery model, locations, relevant sub-tiers, supported systems and missions, data, access, and life-cycle stage.
State the risk scenario, applicable requirement, contract term, control, decision, and assurance needed before choosing the artifact.
Document exclusions, assumptions, unknowns, stale periods, conflicts, and customer-operated controls in language that can be understood without the original meeting context.

Sources for this answer

NIST SP 800-161 Rev. 1 Update 1 C-SCRM

Appendix A explains that established third-party assessments should be checked against enterprise needs and that additional evidence may be necessary for requirements outside their scope.

Section 3

Owner and evidence checklist for supplier questionnaire, proof, and monitoring evidence

Build the evidence request from the supplier category, critical product or service, control and contract requirements, known threats and vulnerabilities, and the decision being made. Name the scope and period so a response about a parent company, different service, or unrelated environment cannot be mistaken for evidence about the assessed relationship.

Use multiple evidence types when the consequence and uncertainty justify the added burden. Supplier assertions describe the supplier's position; policies describe intended design; independent reports describe a scoped assessment; tests and telemetry describe a point-in-time condition; incidents, tickets, performance, and corrective actions show operating history.

Supplier, legal entity, product/service, version, delivery model, locations, sub-tier scope, supported systems and missions, data and access.
Requirement or risk question, requested artifact, evidence owner, source, scope, period, collection method, independence, and validation result.
Exceptions, qualifications, stale or missing evidence, conflicting results, corrective actions, compensating controls, and residual risk.
Decision, authorized approver, contract or acceptance consequence where established, monitoring treatment, expiry date, and event-driven reassessment triggers.

Sources for this answer

NIST SP 800-161 Rev. 1 Update 1 C-SCRM

Appendix A, SR-6 supports consistent supplier-assessment criteria and documented sources; Appendix E adds federal guidance on information quality, confidence, findings, assumptions, impact, response, review, and safeguarding.

Section 4

Common mistakes that weaken NIST SP 800-161 Rev. 1 Supplier Assessment Evidence Guide

Questionnaire completion is not the same as control operation, and a certification or audit report is not automatically relevant to every service, location, sub-tier, system, or requirement. Read the scope, period, exclusions, qualifications, and complementary customer controls.

More evidence can add cost and sensitive data without improving the decision. Request information the team can evaluate and use, allow reuse of suitable existing evidence, protect collected material, and replace or clearly mark stale records.

Do not give equal weight to self-assertion, independent assessment, technical verification, and observed operating history without recording confidence and limitations.
Do not accept a parent-company or platform-wide artifact unless its scope actually includes the contracted legal entity, service, location, and controls.
Do not convert missing evidence into an automatic pass; record uncertainty and choose remediation, added monitoring, compensating controls, alternate sourcing, risk acceptance, or rejection.

Sources for this answer

NIST SP 800-161 Rev. 1 Update 1 C-SCRM

Appendix A advises enterprises to reuse suitable existing supplier evidence, protect assessment data, and make requested transparency commensurate with supplier criticality and inherent risk.

Section 5

Practical workflow for supplier questionnaire, proof, and monitoring evidence

Use evidence throughout the relationship: source selection and award, acceptance and authorization, monitoring, remediation, renewal, material change, incident response, and exit.

The assessment record should explain what each artifact supports, its limitations, the information-quality and confidence judgment, the resulting risk decision, and the next action or review trigger. Appendix E specifies a federal assessment-record baseline; other organizations may adapt those fields, but SP 800-161 does not make that federal record format universally mandatory.

1 | Define the decision | Name the supplier relationship, criticality, risk scenario, requirement, and acquisition or operating decision.
2 | Design the request | Select proportionate artifacts, scope, period, independence, technical checks, delivery method, and protection requirements.
3 | Validate | Confirm provenance, exact coverage, freshness, assessor competence, exceptions, consistency, and evidence of operation.
4 | Decide | Approve, condition approval, remediate, add controls or monitoring, accept residual risk, select an alternative, or escalate.
5 | Sustain | Track evidence expiry, corrective actions, contract commitments, incidents, vulnerabilities, changes, and reassessment triggers.

Sources for this answer

NIST SP 800-161 Rev. 1 Update 1 C-SCRM

Section 3.1.2 covers monitoring after contract execution; Appendix E identifies federal assessment-record fields and records-management requirements.

Primary sources

References and citations

NIST SP 800-161 Rev. 1 Update 1 C-SCRM

doi.org

Referenced sections

Section 3.1.2 covers monitoring after contract execution; Appendix E identifies federal assessment-record fields and records-management requirements.

"Once the contract is executed, the enterprise should monitor for changes that alter its exposure to cybersecurity risks throughout the supply chain."

Related guides