We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Artifact GuideGLOBALNIST SP 800-161 Rev. 1

NIST SP 800-161 Rev. 1 Supplier Risk Tiering

Use consistent supplier categories to focus assurance effort without confusing supplier groupings with NIST's three risk-management levels or CSF Tiers.

Define categories and treatment using your own risk criteria, then retain the rationale for each supplier relationship.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Oct 15, 2026
5 sections2 primary sources
Overview

Assign a to each defined supplier relationship so limited assurance effort follows mission importance and cybersecurity exposure. NIST SP 800-161 Rev. 1, published in May 2022 and updated through 1 November 2024, gives example groupings but does not prescribe supplier tiers, labels, scores, or cutoffs. Define your own criteria and connect each category to specific due diligence, evidence, contract, monitoring, incident, contingency, and approval requirements.

Section 1

Decide what each supplier category changes

SP 800-161's cybersecurity supply chain risk management (C-SCRM) guidance recommends a current inventory of supplier relationships, contracts, and the products and services each supplier provides. It says an organization may map that inventory into strategically relevant groupings, giving strategic/innovative, mission-critical, sustaining, and standard/non-essential as examples. Those labels are illustrative, not mandatory NIST tiers.

Classify the relationship in context, not the supplier's corporate name in isolation. For example, one provider's replaceable administrative service and its component embedded in a mission-critical operational system can require different categories because access, dependency, alternatives, and consequences differ.

  • Inventory the relationship, contract, supplied products and services, supported missions and systems, data and access, locations, sub-tier dependencies, and realistic alternatives.
  • Assess criticality separately from threat, vulnerability, likelihood, current control evidence, and residual risk; do not compress all of them into one unexplained score.
  • Define the treatment that each category activates, including pre-award review, evidence, approval, clauses, flow-down, monitoring, incident participation, continuity, and reclassification triggers.
  • Record the evidence, assumptions, rationale, owner, reviewer, approver, exceptions, and date or event that will trigger review.
Section 2

Define criteria before assigning a category

Set the unit of analysis and category rules before reviewing suppliers. A useful unit is a supplier relationship tied to a product, service, contract, system, or mission. Corporate-level information can inform the decision, but it should not erase material differences among relationships.

Use criteria that lead to action. Criticality, access, data sensitivity, concentration, substitutability, recovery time, ownership or operating location, sub-tier dependence, threat exposure, known vulnerabilities, incident history, and available assurance may all matter. Weighting and thresholds are organizational choices and should be documented.

  • Category rule: state the qualifying conditions, tie-breaker, exception authority, and required treatment.
  • Evidence rule: identify acceptable sources, how conflicting evidence is handled, and what missing information does to the decision.
  • Change rule: define periodic review only where useful and list the supplier, service, access, ownership, dependency, vulnerability, incident, and mission changes that require reclassification.
Section 3

Owner and evidence checklist

Maintain one relationship inventory that connects each supplier to the products and services provided, supported missions and systems, data and access, locations, subcontractors or dependencies, contracts, alternatives, and owners. Apply the category to a defined relationship, not just a corporate name.

Record why the category was assigned and the treatment it activates. Without different evidence, contract, monitoring, incident, contingency, or approval expectations, the label does not prioritize risk work.

  • Supplier and relationship identifier, products/services, supported mission and systems, data, access, locations, sub-tier dependencies, and alternatives.
  • Criticality and risk criteria, source evidence, assumptions, category, rationale, relationship owner, reviewer, and approver.
  • Required assessment depth, evidence, contract and flow-down terms, monitoring, incident participation, contingency, and residual-risk authority for the category.
  • Scheduled review and event triggers for changes to scope, access, dependency, ownership, location, subcontractors, threat, vulnerability, incident history, or substitutability.
Recommended next step

Define supplier categories and treatments

Set the unit of analysis, category rules, required treatment, exception authority, evidence standard, and reclassification triggers.

Assessment workflow
Open Assessment Autopilot

Track relationship mapping, category decisions, treatment, exceptions, and review triggers.

Explore next step
Talk to Sorena
Review the categorization model

Check criteria, evidence, decision authority, treatment differences, and reclassification gaps.

Explore next step
Section 4

Common supplier categorization mistakes

Do not let spend, brand reputation, certification, or questionnaire score stand in for mission dependency. A low-spend embedded component or service can be mission-critical, while a large routine supplier may be readily replaceable and have limited access.

Separate inherent exposure from available assurance and residual risk. A critical supplier with strong controls remains a critical dependency; the evidence changes confidence and treatment, not the underlying mission consequence.

  • Do not confuse supplier categories with SP 800-161's Level 1, Level 2, and Level 3 risk-management views or with CSF implementation Tiers.
  • Do not rate only the prime supplier when a critical sub-tier, component, maintainer, build service, or cloud dependency creates the real exposure.
  • Do not create so many categories that owners cannot explain the difference in required treatment.
Section 5

Supplier categorization workflow

Define categories and treatments at the enterprise level, tailor them for mission and business needs, and apply them to specific relationships and systems. Use an exception route when the standard treatment is infeasible or insufficient.

Tiering is an intake and prioritization mechanism, not the final risk assessment. Follow it with risk analysis. Reclassify when evidence shows that the relationship, dependency, or treatment no longer fits the category.

  • 1 | Define categories | Set a small number of supplier groupings, objective criteria, decision authority, and required treatment for each.
  • 2 | Map relationships | Connect suppliers and sub-tiers to products, services, systems, missions, data, access, contracts, and alternatives.
  • 3 | Classify | Apply the documented rule to criticality, concentration, substitutability, threat, vulnerability, access, ownership or location, and potential impact; record evidence and uncertainty.
  • 4 | Apply treatment | Trigger the category's due diligence, evidence, clauses, testing, monitoring, incident, continuity, approval, and escalation requirements.
  • 5 | Reclassify | Review periodically and after material supplier, service, access, ownership, sourcing, dependency, vulnerability, incident, or mission changes.
Primary sources

References and citations

NIST SP 800-161 Rev. 1 Update 1 C-SCRM
doi.org6 citations
Referenced sections
  • Primary source for supplier relationship inventories, illustrative strategic groupings, prioritization, tailored assurance, acquisition treatment, and life-cycle monitoring.
  • Section 3.1.1 calls for an inventory of supplier relationships, contracts, products, and services, then gives four illustrative strategic groupings to focus analysis, prioritization, assurance, and contract tailoring.
  • Sections 2 and 3.1 connect supplier prioritization to mission criticality, data sensitivity, operational context, single-source dependence, risk assessment, and tailored assurance and acquisition requirements.
Show 3 more
  • Sections 3.1 and 3.5 support maintaining supplier and relationship information, tailoring assurance depth, monitoring for change, and feeding new evidence back into the risk decision.
  • SP 800-161 separates its three risk-management levels from supplier segmentation and explains that supplier exposure depends on the relationship between supplied products or services and the criticality of supported missions, processes, and systems.
  • Sections 3.1 and 3.5 support inventory, strategic grouping, risk-based acquisition treatment, life-cycle monitoring, and reevaluation after changes in risk conditions.
NIST CSF 2.0 (CSWP 29)
doi.org2 citations
Referenced sections
  • Official NIST source for CSF Implementation Tiers, which should not be repurposed as supplier grades.
  • CSF Implementation Tiers characterize the rigor of organizational cybersecurity risk governance and management; they are not supplier risk categories.

Related guides

NIST SP 800-161 Rev. 1 C-SCRM Governance Checklist

A NIST SP 800-161 Rev. 1 checklist for assigning C-SCRM decisions across enterprise, mission/business-process, and operational levels.

NIST SP 800-161 Rev. 1 C-SCRM Governance Guide

Design NIST SP 800-161 Rev. 1 C-SCRM governance across the enterprise, mission/business-process, and operational levels with accountable roles and feedback loops.

NIST SP 800-161 Rev. 1 Contract and Monitoring Controls

Translate C-SCRM risk decisions into supplier clauses, subcontractor flow-down, evidence delivery, revalidation, monitoring, incident, continuity, and exit terms.

NIST SP 800-161 Rev. 1 Criticality Analysis Guide

Identify mission-critical functions, systems, components, products, services, suppliers, and single-source dependencies so C-SCRM effort follows potential impact.

NIST SP 800-161 Rev. 1 FAQ: practical implementation questions

NIST SP 800-161 Rev. 1 answers with cited implementation steps, decision criteria, and evidence guidance.

NIST SP 800-161 Rev. 1 implementation playbook

Build a tailored C-SCRM program with strategy, policy, plans, assessments, acquisition controls, monitoring, and evidence across NIST's three risk-management levels.

Show all related guides (19)

NIST SP 800-161 Rev. 1 Provenance and SBOM Supplier Controls

Use provenance, SBOM, build integrity, authenticity, and supplier evidence together to manage software and component risk under NIST SP 800-161 Rev. 1.

NIST SP 800-161 Rev. 1 supplier assessment evidence: risk-based records and evaluation criteria

Choose and validate supplier evidence based on criticality, risk, contract requirements, source reliability, freshness, and proof of operating effectiveness.

NIST SP 800-161 Rev. 1 vs DORA ICT third-party risk: practical side-by-side comparison

Compare NIST SP 800-161 Rev. 1 and DORA ICT third-party risk with side-by-side scope, owner, trigger, evidence, cadence, assurance, and decision-rule rows.

NIST SP 800-161 Rev. 1 vs ISO/IEC 27036 supplier relationships: practical side-by-side comparison

Compare NIST SP 800-161 Rev. 1 and ISO/IEC 27036 supplier relationships with side-by-side scope, owner, trigger, evidence, cadence, assurance, and decision-rule rows.

NIST SP 800-161 Rev. 1: workflow for collecting and validating C-SCRM supplier evidence

A risk-based NIST SP 800-161 supplier evidence workflow from relationship scope and criticality through request, validation, decision, remediation, and monitoring.

How should teams handle counterfeits under NIST SP 800-161 Rev. 1 supply-chain risk management?

Prioritize critical items, use traceable sources, verify authenticity and tamper protection, quarantine suspected counterfeits, and reassess affected risk.

How should teams handle critical suppliers under NIST SP 800-161 Rev. 1 supply-chain risk management?

Identify critical suppliers through mission dependency, component importance, access, concentration, substitutability, and potential impact, not spend alone.

How should teams handle monitoring under NIST SP 800-161 Rev. 1 supply-chain risk management?

Run risk-based supplier monitoring with scheduled revalidation, event triggers, operating signals, escalation thresholds, corrective action, and evidence.

How should teams handle provenance under NIST SP 800-161 Rev. 1 supply-chain risk management?

Collect and verify traceable origin, build, dependency, custody, authenticity, and change evidence for critical systems, components, software, and data.

How should teams handle supplier incidents under NIST SP 800-161 Rev. 1 supply-chain risk management?

Coordinate supplier incidents through joint triage, evidence preservation, containment, recovery, contract communication, corrective action, and reassessment.

How should teams handle supply chain risk response under NIST SP 800-161 Rev. 1 supply-chain risk management?

Choose and document whether to accept, avoid, mitigate, share, or transfer supply-chain risk, with authority, actions, residual risk, and review triggers.

How should teams handle tiering under NIST SP 800-161 Rev. 1 supply-chain risk management?

Build supplier risk categories that drive assurance treatment while keeping them distinct from SP 800-161 risk-management levels and CSF Tiers.

Which contract controls should teams define under NIST SP 800-161 Rev. 1?

Translate supplier risk into measurable security, flow-down, evidence, monitoring, incident, continuity, remediation, and exit clauses under SP 800-161.