We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

WorkflowGLOBALNIST SP 800-161 Rev. 1

NIST SP 800-161 Rev. 1 Supplier Assessment Evidence Workflow

Request only the evidence needed for the supplier risk decision, validate its exact scope and reliability, and turn gaps into explicit acquisition or operating action.

Choose evidence for the actual risk decision and supplier scope. SP 800-161 does not prescribe one universal questionnaire, artifact list, approval threshold, or reassessment frequency.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Oct 15, 2026
3 sections1 primary sources
Overview

Use this workflow when a supplier, product, or service must be assessed before selection, award, deployment, continued use, renewal, or exit. NIST SP 800-161 Rev. 1 was published in May 2022 and Update 1 includes changes through 1 November 2024. Start with the decision and risk context, request proportionate evidence, validate what each artifact covers, and record the resulting risk response. SP 800-161 provides guidance, not a universal questionnaire, evidence package, approval threshold, or reassessment interval.

Section 1

Request and review workflow

Start from a defined relationship and decision, not a standard questionnaire. The supplier category, critical product or service, supported mission and system, access, data, sub-tier dependencies, life-cycle stage, known threats, and risk tolerance determine what evidence is proportionate.

Treat the stages as an iterative control loop. New evidence, an unresolved conflict, a material supplier change, or an incident can send the assessment back to scoping, evidence collection, or risk response.

  • 1 | Frame the assessment | Owner: mission/business-process and system owners with acquisition and support | Record the legal entity, product or service and version, delivery model, locations, relevant sub-tiers, supported mission and systems, access and data, criticality, risk scenario, life-cycle stage, and decision to be made.
  • 2 | Design the request | Owner: acquisition, engineering, control, and risk leads | Map each risk question and requirement to proportionate evidence, such as due-diligence research, a questionnaire, policy, independent assessment, test result, provenance or software bill of materials (SBOM) data, vulnerability and incident history, continuity evidence, site visit, or technical verification.
  • 3 | Collect and protect | Owner: supplier manager or assessment coordinator | State the exact entity, product, service, location, control, and period requested; set the delivery channel, due date, correction route, handling, access, retention, and disposal rules. Apply contract consequences only when the contract or other authority establishes them.
  • 4 | Validate | Owner: reviewers with the required technical, acquisition, business, and risk competence | Check source provenance, scope match, date and covered period, independence, assessor qualifications, methods, exceptions, complementary customer controls, consistency with other evidence, and whether the artifact shows control design or operation.
  • 5 | Resolve gaps | Owner: supplier manager, control owner, and risk owner | If evidence is missing, stale, conflicting, or out of scope, request clarification or added evidence, perform a technical check, add a compensating control, set corrective action, narrow the use case, or escalate the uncertainty. Do not convert an unanswered question into a pass.
  • 6 | Decide and monitor | Owner: the authority designated by enterprise policy and the acquisition or authorization process | Record the response: proceed, proceed with conditions, mitigate, accept residual risk, select an alternative, reject, suspend, or exit. Track commitments, evidence expiry, vulnerabilities, incidents, ownership or location changes, sub-tier changes, product updates, and other reassessment triggers.
Recommended next step

Put this NIST SP 800-161 Rev. 1 C-SCRM guidance into practice

Use the cited sources to turn the guidance into scoped decisions, owners, evidence requests, and review checkpoints.

Assessment workflow
Open Assessment Autopilot for NIST SP 800-161 Rev. 1 C-SCRM

Create cited tasks, evidence requests, and review checkpoints for this NIST SP 800-161 Rev. 1 C-SCRM scope.

Explore next step
Talk to Sorena
Review this NIST SP 800-161 Rev. 1 C-SCRM scope with Sorena

Review the evidence request, reviewer responsibilities, unresolved findings, and authority for the supplier decision.

Explore next step
Section 2

Decision checkpoints

The reviewer should state what each artifact proves, what it does not prove, and how any uncertainty changes the acquisition or operating decision. A certificate, independent report, or parent-company policy is relevant only when its scope covers the contracted entity, product or service, locations, controls, and period at issue.

NIST says assessment information should be evaluated against consistent baseline factors so suppliers and results can be compared over time. Add context-specific factors when the decision requires them.

  • Does the evidence cover the contracted entity, exact product/service and version, relevant locations/sub-tiers, controls, and review period?
  • Is it a supplier assertion, control design document, independent assessment, technical test, operating record, or observed performance, and what confidence does that source justify?
  • Are exceptions, qualifications, stale periods, unknown dependencies, complementary controls, and corrective actions reflected in residual risk?
  • Does the reviewer have the technical and business competence to evaluate it, and does the approver have authority to accept the remaining risk?
Section 3

Evidence fields

Keep enough structure to compare decisions and refresh them without reducing the assessment to a score. Appendix E's detailed record fields apply to the federal supply chain risk assessment context described there; non-federal organizations can use them as a reference, not as a mandatory form.

Protect sensitive supplier and assessment information. Set marking, access, handling, retention, disclosure, and disposal requirements under applicable law, policy, and contract.

  • Context: purpose, life-cycle stage, supported mission or system, criticality, use case, risk scenario, requirement, applicable contract term, assumptions, and constraints.
  • Subject: supplier legal entity, product or service, version or identifier, delivery model, location, relevant sub-tiers, data, access, and dependencies.
  • Evidence: artifact type, source, covered scope and period, issue and expiry dates, collection channel, protection marking, and source citation.
  • Evaluation: method, reviewer, independence and competence, information quality, scope match, exceptions, confidence, design-versus-operation conclusion, conflicts, and rationale.
  • Outcome: impact, risk determination, response, corrective action, compensating control, due date, verification, residual risk, approver, escalation, and next scheduled or event-driven review.
Primary sources

References and citations

NIST SP 800-161 Rev. 1 Update 1 C-SCRM
doi.org4 citations
Referenced sections
  • Primary source for supplier due diligence, assessment criteria, evidence techniques, acquisition decisions, monitoring, controls, and the federal assessment-record guidance qualified on this page.
  • Section 3.1.2 covers due diligence, supplier evidence, multidisciplinary review, pre-deployment risk assessment, contract monitoring, and revalidation across the acquisition life cycle.
  • Appendix A, SR-6 calls for consistent baseline factors, context-specific criteria, attention to information quality, and documentation of reference sources for supplier assessments.
Show 1 more
  • Appendix E, Sections E.3.1-E.3.2 describe federal assessment-record content, information-quality and confidence fields, methodology, review, safeguarding, and records management.
"The type and rigor of the required methods should be commensurate with the criticality of the service or product being acquired and the corresponding assurance requirements."
More quoted passages
"Enterprises should not treat the initial C-SCRM due diligence risk assessment as exhaustive."
"Reference sources for assessment information should also be documented."
"Broadly, quality information should be timely, relevant, unbiased, sufficiently complete or provided in-context, and attained from credible sources."

Related guides

NIST SP 800-161 Rev. 1 C-SCRM Governance Checklist

A NIST SP 800-161 Rev. 1 checklist for assigning C-SCRM decisions across enterprise, mission/business-process, and operational levels.

NIST SP 800-161 Rev. 1 C-SCRM Governance Guide

Design NIST SP 800-161 Rev. 1 C-SCRM governance across the enterprise, mission/business-process, and operational levels with accountable roles and feedback loops.

NIST SP 800-161 Rev. 1 Contract and Monitoring Controls

Translate C-SCRM risk decisions into supplier clauses, subcontractor flow-down, evidence delivery, revalidation, monitoring, incident, continuity, and exit terms.

NIST SP 800-161 Rev. 1 Criticality Analysis Guide

Identify mission-critical functions, systems, components, products, services, suppliers, and single-source dependencies so C-SCRM effort follows potential impact.

NIST SP 800-161 Rev. 1 FAQ: practical implementation questions

NIST SP 800-161 Rev. 1 answers with cited implementation steps, decision criteria, and evidence guidance.

NIST SP 800-161 Rev. 1 implementation playbook

Build a tailored C-SCRM program with strategy, policy, plans, assessments, acquisition controls, monitoring, and evidence across NIST's three risk-management levels.

Show all related guides (19)

NIST SP 800-161 Rev. 1 Provenance and SBOM Supplier Controls

Use provenance, SBOM, build integrity, authenticity, and supplier evidence together to manage software and component risk under NIST SP 800-161 Rev. 1.

NIST SP 800-161 Rev. 1 supplier assessment evidence: risk-based records and evaluation criteria

Choose and validate supplier evidence based on criticality, risk, contract requirements, source reliability, freshness, and proof of operating effectiveness.

NIST SP 800-161 Rev. 1 Supplier Risk Tiering

Group suppliers by mission dependency and cyber risk, then tie each category to proportionate due diligence, evidence, contracts, monitoring, and response.

NIST SP 800-161 Rev. 1 vs DORA ICT third-party risk: practical side-by-side comparison

Compare NIST SP 800-161 Rev. 1 and DORA ICT third-party risk with side-by-side scope, owner, trigger, evidence, cadence, assurance, and decision-rule rows.

NIST SP 800-161 Rev. 1 vs ISO/IEC 27036 supplier relationships: practical side-by-side comparison

Compare NIST SP 800-161 Rev. 1 and ISO/IEC 27036 supplier relationships with side-by-side scope, owner, trigger, evidence, cadence, assurance, and decision-rule rows.

How should teams handle counterfeits under NIST SP 800-161 Rev. 1 supply-chain risk management?

Prioritize critical items, use traceable sources, verify authenticity and tamper protection, quarantine suspected counterfeits, and reassess affected risk.

How should teams handle critical suppliers under NIST SP 800-161 Rev. 1 supply-chain risk management?

Identify critical suppliers through mission dependency, component importance, access, concentration, substitutability, and potential impact, not spend alone.

How should teams handle monitoring under NIST SP 800-161 Rev. 1 supply-chain risk management?

Run risk-based supplier monitoring with scheduled revalidation, event triggers, operating signals, escalation thresholds, corrective action, and evidence.

How should teams handle provenance under NIST SP 800-161 Rev. 1 supply-chain risk management?

Collect and verify traceable origin, build, dependency, custody, authenticity, and change evidence for critical systems, components, software, and data.

How should teams handle supplier incidents under NIST SP 800-161 Rev. 1 supply-chain risk management?

Coordinate supplier incidents through joint triage, evidence preservation, containment, recovery, contract communication, corrective action, and reassessment.

How should teams handle supply chain risk response under NIST SP 800-161 Rev. 1 supply-chain risk management?

Choose and document whether to accept, avoid, mitigate, share, or transfer supply-chain risk, with authority, actions, residual risk, and review triggers.

How should teams handle tiering under NIST SP 800-161 Rev. 1 supply-chain risk management?

Build supplier risk categories that drive assurance treatment while keeping them distinct from SP 800-161 risk-management levels and CSF Tiers.

Which contract controls should teams define under NIST SP 800-161 Rev. 1?

Translate supplier risk into measurable security, flow-down, evidence, monitoring, incident, continuity, remediation, and exit clauses under SP 800-161.