Use consistent supplier categories to focus assurance effort without confusing supplier groupings with NIST's three risk-management levels or CSF Tiers.
Supplier categories are an organizational prioritization choice, not NIST's three risk-management levels or CSF Implementation Tiers. Define categories and treatment using your own risk criteria.
Structured answer sets in this page tree.
Cited legal and guidance references.
Assign a to each defined supplier relationship so limited assurance effort follows mission importance and cybersecurity exposure. NIST SP 800-161 Rev. 1, published in May 2022 and updated through 1 November 2024, gives example groupings but does not prescribe supplier tiers, labels, scores, or cutoffs. Define your own criteria and connect each category to specific due diligence, evidence, contract, monitoring, incident, contingency, and approval requirements.
SP 800-161's cybersecurity supply chain risk management (C-SCRM) guidance recommends a current inventory of supplier relationships, contracts, and the products and services each supplier provides. It says an organization may map that inventory into strategically relevant groupings, giving strategic/innovative, mission-critical, sustaining, and standard/non-essential as examples. Those labels are illustrative, not mandatory NIST tiers.
Classify the relationship in context, not the supplier's corporate name in isolation. For example, one provider's replaceable administrative service and its component embedded in a mission-critical operational system can require different categories because access, dependency, alternatives, and consequences differ.
Set the unit of analysis and category rules before reviewing suppliers. A useful unit is a supplier relationship tied to a product, service, contract, system, or mission. Corporate-level information can inform the decision, but it should not erase material differences among relationships.
Use criteria that lead to action. Criticality, access, data sensitivity, concentration, substitutability, recovery time, ownership or operating location, sub-tier dependence, threat exposure, known vulnerabilities, incident history, and available assurance may all matter. Weighting and thresholds are organizational choices and should be documented.
Maintain one relationship inventory that connects each supplier to the products and services provided, supported missions and systems, data and access, locations, subcontractors or dependencies, contracts, alternatives, and owners. Apply the category to a defined relationship, not just a corporate name.
Record why the category was assigned and the treatment it activates. A label without different evidence, contract, monitoring, incident, contingency, and approval expectations is administrative decoration rather than risk prioritization.
Set the unit of analysis, category rules, required treatment, exception authority, evidence standard, and reclassification triggers.
Track relationship mapping, category decisions, treatment, exceptions, and review triggers.
Check criteria, evidence, decision authority, treatment differences, and reclassification gaps.
Do not let spend, brand reputation, certification, or questionnaire score stand in for mission dependency. A low-spend embedded component or service can be mission-critical, while a large routine supplier may be readily replaceable and have limited access.
Separate inherent exposure from available assurance and residual risk. A critical supplier with strong controls remains a critical dependency; the evidence changes confidence and treatment, not the underlying mission consequence.
Define categories and treatments at the enterprise level, tailor them for mission and business needs, and apply them to specific relationships and systems. Use an exception route when the standard treatment is infeasible or insufficient.
Tiering is an intake and prioritization mechanism, not the final risk assessment. Follow it with risk analysis. Reclassify when evidence shows that the relationship, dependency, or treatment no longer fits the category.