Framework

NIST SP 800-161r1
cybersecurity supply chain risk management for enterprise teams

NIST Special Publication 800-161 Revision 1 (May 2022, with the 2024 IPD update on AI considerations) is the federal cybersecurity supply chain risk management framework. It defines the C-SCRM strategy, the C-SCRM plan, the supplier risk management policy, the integration of supply chain risk with NIST SP 800-39 enterprise risk management and NIST SP 800-37 risk management framework, and the security controls in NIST SP 800-53 Rev. 5 that carry the supply chain risk implications. This page covers the three operating tiers, the C-SCRM artefact set, the SR control family in 800-53, the evidence the framework expects, and where 800-161r1 sits alongside SLSA, SSDF, SBOM, EU CRA, and the wider supply chain risk regime.

Get Started Free

No credit card required. Free plan available forever.

NIST SP 800-161r1 explained for enterprise teams

NIST Special Publication 800-161 Revision 1 (Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, May 2022) is the federal C-SCRM framework. It defines the C-SCRM strategy, the C-SCRM plan, the supplier risk management policy, the integration with NIST SP 800-39 enterprise risk management, the operating tiers, and the security controls in NIST SP 800-53 Rev. 5 that carry the supply chain risk implications. The 2024 IPD update adds AI considerations as a layered context across the same operating model rather than a separate framework.

For internal security teams, GRC owners, vendor risk leads, AppSec teams managing third-party components, and CISOs accountable for supply chain risk, 800-161r1 is the operating reference the federal customer base reads against and the strategy spine the wider supply chain regime (SLSA, SSDF, SBOM, EU CRA, DORA Article 28) reads beside. The framework is dense; the value is the integration of the strategy with the enterprise risk register and the operating tier model that turns supply chain risk from a procurement side concern into a cross-functional discipline.

This page walks through the three operating tiers, the SR control family in NIST SP 800-53 Rev. 5, the C-SCRM artefact set, the integration with adjacent NIST publications, the practical adoption sequence, the failure modes the framework was published to address, and where 800-161r1 sits alongside SLSA, SSDF, SBOM, and the EU Cyber Resilience Act. Programmes that adopt 800-161r1 as the strategy layer and read SLSA, SSDF, SBOM, and CRA as the artefact layers below produce a coherent supply chain posture that holds up under federal, EU, financial, and audit-committee scrutiny.

The three operating tiers

800-161r1 inherits the three-tier risk management model from NIST SP 800-39. The tiers are not separate programmes; they are the layers of the same programme. The strategy at Tier 1 constrains the plan at Tier 2, which constrains the system-level evidence at Tier 3. Read bottom-up: the system evidence at Tier 3 is the consequence of the plan at Tier 2, which is the consequence of the strategy at Tier 1. Read top-down: the strategy is the source the rest reads against.

Tier 1: Enterprise

Sits at the enterprise level and is owned by senior leadership. The C-SCRM strategy names the supply chain risk appetite, the integration with the enterprise risk management programme, the cross-functional governance roles (legal, procurement, IT, security, business owners), the C-SCRM policy hierarchy, and the executive accountability. Tier 1 is what an audit committee, a federal customer, or a regulator looks at first: it answers the question of whether the programme is real or implied.

Tier 2: Mission and business process

Translates the Tier 1 strategy into the operating posture for a defined business line, mission, or product family. The C-SCRM plan at this tier names the criticality classification of the supply chain elements, the supplier categorisation, the C-SCRM control tailoring per supplier tier, the contract clauses, the assessment cadence, and the integration with procurement and vendor management. Procurement, vendor risk, and product owners read the plan day to day.

Tier 3: System and component

Applies the C-SCRM controls to a specific system or service. The Tier 3 evidence carries the supplier inventory for the system, the SBOM-aligned component inventory, the SLSA-aligned build provenance where applicable, the supplier security questionnaire results, the assessment record for high-criticality components, and the residual risk acceptance per supplier and per component class. Tier 3 is where the abstract policy hits the operating record.

The SR control family in NIST SP 800-53 Rev. 5

The Supply Chain Risk Management (SR) family in NIST SP 800-53 Rev. 5 is the operating control set 800-161r1 reads against. The twelve baseline SR controls below carry the supply chain dimension; the C-SCRM enhancements layered across the other 800-53 families (AC access control, CM configuration management, IR incident response, MA maintenance, PM program management, PS personnel security, RA risk assessment, SA system and services acquisition, SC system and communications protection, SI system and information integrity) extend the same context to the rest of the catalogue. The audit read against an SR control is operating evidence, not policy assertion.

  • SR-1 Policy and Procedures: a documented C-SCRM policy and the procedures that operationalise it. The policy is the artefact every other SR control inherits from, so the absence of SR-1 turns the rest of the family cosmetic.
  • SR-2 Supply Chain Risk Management Plan: the C-SCRM plan that names the supply chain risk appetite, the criticality classification, the supplier tiering, the control tailoring per tier, and the assessment cadence. SR-2 is the Tier 2 operating artefact.
  • SR-3 Supply Chain Controls and Processes: the technical and procedural controls applied to suppliers and components. SR-3 reads against the SBOM, the build provenance, the secure-development practices the supplier evidences, and the runtime assurances the consumer requires.
  • SR-4 Provenance: documented provenance for systems, components, and services. SR-4 reads against SBOM, signed build attestations, and the cryptographic verification record that closes the gap between what was built and what was deployed.
  • SR-5 Acquisition Strategies and Tools: the acquisition discipline that codifies C-SCRM in procurement. SR-5 is where the contract templates, the supplier questionnaire library, and the acquisition decision record live.
  • SR-6 Supplier Assessments and Reviews: the cadence on which suppliers are assessed against the documented expectations. SR-6 evidence is the questionnaire response, the on-site or remote assessment record where applicable, the attestation review, and the residual risk acceptance after the assessment.
  • SR-7 Supply Chain Operations Security: the operational security practices that protect supply chain integrity in transit, at handoff, and at rest. SR-7 reads against the secure-handling procedures for components, the controlled-access expectations for supplier-side environments, and the integrity verification at receipt.
  • SR-8 Notification Agreements: the contractual agreements that oblige suppliers to notify on relevant security events (vulnerabilities, breaches, incidents, ownership changes). SR-8 is the legal-language anchor that turns notification from goodwill into obligation.
  • SR-9 Tamper Resistance and Detection: the controls that establish whether a system or component has been tampered with along the supply chain. SR-9 reads against tamper-evident packaging where physical, signed-and-verified attestations where digital, and integrity-verification testing where applicable.
  • SR-10 Inspection of Systems or Components: the inspection discipline that confirms what was received matches what was specified. SR-10 reads against receipt inspection, build verification, and the post-receipt integrity confirmation.
  • SR-11 Component Authenticity: the controls that confirm components are genuine rather than counterfeit, cloned, or otherwise inauthentic. SR-11 reads against signed-and-verifiable component metadata, vendor authenticity programmes, and the inspection patterns SR-10 names.
  • SR-12 Component Disposal: the disposal discipline for retired components, both first-party and supplier. SR-12 closes the lifecycle: components leaving service carry the integrity, sanitisation, and disposal evidence the rest of the family established at acquisition.

The C-SCRM artefact set

The artefact set the framework expects is enumerated rather than implied. The minimum durable pack is grouped by tier so the audit read can walk the strategy, the plan, the system-level evidence, and the cross-tier records as separate sections of the same record rather than as a single narrative. Each artefact has a named owner, a refresh cadence, and a version history so reconstruction at audit time is replaced with a continuous operating trail.

  • Tier 1: the C-SCRM strategy, the C-SCRM policy, the supply chain risk appetite statement, the named executive accountability, the integration with the enterprise risk management programme, and the cross-functional governance charter.
  • Tier 2: the C-SCRM plan per mission or business line, the supplier criticality classification, the supplier tiering with the assessment cadence per tier, the contract templates and the procurement-side checklists, and the integration with the vendor risk management process.
  • Tier 3: the supplier inventory for the system, the SBOM-aligned component inventory at point in time, the build provenance for first-party components, the supplier questionnaire and assessment record, the residual risk acceptance per high-criticality supplier, and the disposal record for retired components.
  • Cross-tier: the SR control evidence in NIST SP 800-53 Rev. 5, the C-SCRM enhancements applied across the other control families, the breach and vulnerability notification log under SR-8, and the audit trail of changes to the supplier inventory and the component inventory over time.

Integration with adjacent NIST publications

800-161r1 is explicit that C-SCRM is a sub-discipline of enterprise risk management and is integrated with the wider NIST publication set. The relationships below are the ones programmes encounter most often when they read 800-161r1 against the rest of the federal cybersecurity reference shelf. The integrations matter because the framework is not intended to be operated in isolation; the artefacts read across publications.

  • NIST SP 800-39 (Managing Information Security Risk): the enterprise risk management framework into which C-SCRM is integrated. The C-SCRM strategy and the supply chain risk register read into the same enterprise risk record the rest of the cyber programme writes to.
  • NIST SP 800-37 Rev. 2 (Risk Management Framework): the seven-step RMF lifecycle through which C-SCRM controls are applied. C-SCRM is not a parallel programme; it is a context that overlays the RMF Categorise, Select, Implement, Assess, Authorise, and Monitor steps for systems with supply chain dimensions.
  • NIST SP 800-53 Rev. 5: the security and privacy control catalogue. The SR control family is the named C-SCRM anchor, and the supply chain enhancements layered across the other families (AC, CM, IR, MA, PM, PS, RA, SA, SC, SI) extend C-SCRM context where the supply chain dimension applies.
  • NIST SP 800-218 (Secure Software Development Framework, SSDF): the secure software development practices catalogue. SSDF practices PO, PS, PW, and RV are the development-side practices a supplier (or a first-party software team) is expected to evidence; 800-161r1 reads SSDF as the development-side input to C-SCRM.
  • NIST SP 800-171 Rev. 3 and CMMC: the federal contractor and DIB control sets that consume C-SCRM evidence. Federal customers reading 800-171 and CMMC against a contractor pipeline expect the C-SCRM strategy, the supplier inventory, and the assessment record alongside the rest of the control package.
  • EO 14028 and CISA Secure Software Development Attestation: the federal procurement-side instruments that operationalise the C-SCRM expectations for software the federal government acquires. The SSDA attestation reads against the SSDF, which reads against 800-161r1.

A practical adoption sequence

The framework is designed to be operated in a sequence rather than addressed in parallel. The cadence below is the practical ordering most programmes follow when 800-161r1 is treated as an operating baseline rather than a checklist. The cycle compounds: each tier inherits evidence from the prior tier, so the audit pack at the end of the cycle is the residue of the operating work rather than a separate compilation produced at reading time.

  1. 1Establish Tier 1: document the C-SCRM strategy, the C-SCRM policy, the supply chain risk appetite, and the named executive accountability. Tier 1 is the cheapest tier in time and cost and the most expensive tier to skip, because every Tier 2 and Tier 3 artefact inherits from it.
  2. 2Build the supplier inventory and the criticality classification at Tier 2. Without an inventory, the assessment cadence cannot be tiered, the contract clauses cannot be targeted, and the residual risk cannot be sized. The inventory is the foundational record the rest of the programme reads against.
  3. 3Tier the supplier set and assign the assessment cadence per tier. High-criticality suppliers carry more frequent assessments, deeper questionnaire scopes, and contractual notification obligations. Low-criticality suppliers carry lighter assessments. The tiering decision and the rationale are recorded so the audit read is reconcilable.
  4. 4Operate the SR control set against the inventory. SR-1 to SR-12 are operated continuously rather than annually; the activity is the daily procurement, contract, assessment, and assurance work the programme already does, with the C-SCRM context attached so the SR evidence is produced as a side effect.
  5. 5Integrate the C-SCRM record with the enterprise risk register. Standalone supply chain registers that do not reconcile with the enterprise risk record are a documented anti-pattern; the supply chain risks live on the same risk record the rest of the cyber programme writes to so leadership reads one record rather than three.
  6. 6Layer SBOM, build provenance, and SLSA evidence onto the Tier 3 record where software is in scope. The component inventory, the build attestations, and the cryptographic verification close the development-side and the consumption-side gap that 800-161r1 names but does not fully prescribe.
  7. 7Operate the assessment cadence and refresh the artefact set on an annual rhythm. The assessment record refreshes, the SBOM refreshes, the contract templates refresh, the supplier inventory refreshes, and the C-SCRM strategy and plan refresh on at least an annual cadence and on material change (acquisition, divestiture, major supplier change, regulatory change).

Failure modes the framework is designed to surface

The framework is forgiving on the choice of tooling, the contract templates, and the prioritisation order within a tier. It is unforgiving about a small number of patterns that turn the C-SCRM programme cosmetic rather than operational. The patterns below recur across C-SCRM adoptions and are the ones that erode the year-over-year continuity audits and federal customers read against.

  • Treating C-SCRM as a procurement-only programme. The framework is explicit that C-SCRM is cross-functional. Programmes that confine C-SCRM to procurement build a contract library and miss the assessment cadence, the integrity verification, and the residual risk acceptance the SR family expects.
  • Treating C-SCRM as a security-only programme. The mirror failure mode. Security teams that operate C-SCRM without procurement, legal, vendor risk, and business owners produce assessment records that procurement does not read and contract clauses that vendor risk does not enforce.
  • Standalone supply chain risk registers. Programmes that maintain a supply chain risk register that does not reconcile with the enterprise risk register produce parallel records that drift, and the two diverge by the second annual review. The framework integrates with NIST SP 800-39 specifically to prevent this drift.
  • Surveying the supplier inventory rather than ingesting it. Spreadsheet surveys against business units satisfy the artefact in name but fail under audit because the record cannot answer the question What is the current supplier inventory today. The inventory has to be a structured, queryable record refreshed on cadence.
  • Treating SBOM as a one-off snapshot. SBOM is an evergreen artefact in 800-161r1, refreshed on every release and on every dependency change. SBOMs filed at point of acquisition and never refreshed read as evidence under the framework but produce no operating value.
  • Confusing 800-161r1 with SLSA, SSDF, or SBOM. The four publications stack rather than substitute. Programmes that adopt SLSA, declare a C-SCRM programme, and stop have a build-integrity scaffold but no strategy, no plan, no supplier assessment, and no integration with the enterprise risk register.
  • Letting Tier 1 atrophy. Tier 1 artefacts (strategy, policy, appetite) are cheap to file and expensive to keep current. Programmes that file Tier 1 once and never refresh discover at the third year that the strategy references retired suppliers, retired risk appetites, and retired executive sponsors, and the audit read is reconstructed.

How 800-161r1 relates to adjacent regimes

800-161r1 sits in a busy regulatory and standards neighbourhood. The relationships below are the ones programmes encounter most often when they read 800-161r1 against the rest of the supply chain regime. Programmes operating across regions and sectors use 800-161r1 as the strategy spine and read SLSA, SSDF, SBOM, EU CRA, DORA, and ISO 27036 as the artefact layers below.

800-161r1 vs SLSA

SLSA is the OpenSSF build-integrity scaffold. It defines four levels of build provenance and signing assurance. 800-161r1 is the strategy-and-controls layer that names where SLSA evidence sits in the Tier 3 artefact set. Programmes operating both use 800-161r1 to define the C-SCRM strategy and SLSA to evidence the build-side integrity SR-4 (Provenance) reads against.

800-161r1 vs SSDF (NIST SP 800-218)

SSDF is the secure software development practices catalogue. Practices PO (Prepare the Organisation), PS (Protect the Software), PW (Produce Well-Secured Software), and RV (Respond to Vulnerabilities) describe the development-side discipline a supplier or first-party team is expected to evidence. 800-161r1 reads SSDF as the development-side input to the consumer-side C-SCRM controls. The CISA Secure Software Development Attestation form is the federal procurement-side instrument that operationalises the expectation.

800-161r1 vs SBOM

SBOM (SPDX or CycloneDX) is the component inventory artefact. 800-161r1 names SBOM as the inventory artefact the SR-4 Provenance and SR-3 Supply Chain Controls evidence reads against. SBOM is necessary and not sufficient: the inventory is the input, the assessment, the residual risk acceptance, and the integration with the enterprise risk register are the outputs.

800-161r1 vs EU Cyber Resilience Act

EU CRA is the regulation that obliges manufacturers placing products with digital elements on the EU market to maintain SBOM, vulnerability handling, and lifecycle security obligations. 800-161r1 is the federal cybersecurity supply chain risk management framework. The two read against shared artefacts (SBOM, vulnerability handling, supplier notification) and produce parallel evidence packs for parallel readers.

800-161r1 vs DORA (Article 28 Third-Party ICT Risk)

DORA Article 28 imposes detailed third-party ICT risk obligations on financial entities operating in the EU. 800-161r1 is the federal C-SCRM framework. Financial entities subject to both regimes operate one supply chain risk programme that produces evidence readable under both: the supplier inventory, the criticality classification, the contract clauses, the assessment cadence, and the residual risk acceptance feed into both DORA Article 28 and 800-161r1 simultaneously.

800-161r1 vs ISO 27036

ISO/IEC 27036 (Information security for supplier relationships) is the ISO supplier relationship security standard. 800-161r1 is the NIST C-SCRM framework. The two are complementary rather than competing: ISO 27036 supplies the supplier-relationship vocabulary the procurement and vendor risk teams use globally, while 800-161r1 supplies the federal-grade C-SCRM strategy and SR control set. Programmes that operate against both regimes use 800-161r1 as the strategy spine and ISO 27036 as the supplier-relationship counterpart.

Where SecPortal fits in a C-SCRM programme

SecPortal is the operating layer for the C-SCRM cycle, not a replacement for the NIST publication or for the procurement, vendor risk, and legal functions accountable for the supplier-side artefacts. The platform handles the C-SCRM-side workstreams (engagement structure, supplier-record alignment with findings, severity scoring, treatment dispositions, retest evidence, leadership reporting) so the inputs the SR family expects are produced as structured records rather than reconstructed at audit time. The same workspace that hosts the engagement record hosts the SAST, dependency analysis, authenticated DAST, external scanning, and continuous monitoring evidence the Tier 3 record depends on, so the line from artefact to control stays traceable.

  • Engagement management dedicated to the C-SCRM operating cycle, with workstreams per tier (Tier 1 strategy refresh, Tier 2 plan refresh per business line, Tier 3 system-level assessments) tracked as recurring engagements rather than one-off documents stitched together at audit time
  • Findings management with CVSS 3.1 scoring, CWE tags, and structured fields so the supply chain vulnerabilities raised through SAST, dependency analysis, and external assessment feed the SR-3 Supply Chain Controls and SR-6 Supplier Assessment evidence against the cadence the framework expects
  • Code scanning (Semgrep-based SAST and dependency analysis) and repository connections via GitHub, GitLab, and Bitbucket OAuth that produce the first-party software side of the C-SCRM record (SBOM-aligned dependency inventory, dependency vulnerability triage, build-side findings) on the same workspace as the supplier-side evidence
  • External scanning and authenticated DAST that feed the runtime side of the C-SCRM record so the consumed-software posture (deployed third-party components, supplier-managed services) is observable against the same operating cadence as the build-side posture
  • Continuous monitoring schedules (daily, weekly, biweekly, monthly) that establish the recurring cadence the SR-6 supplier assessments and the SR-3 supply chain controls expect, with the scan history establishing the audit trail rather than an attestation
  • Document management for the C-SCRM strategy, the C-SCRM policy, the C-SCRM plan per business line, the supplier inventory exports, the SBOM artefacts (SPDX or CycloneDX), the contract templates, the assessment questionnaires, and the residual risk acceptance records, with version history per artefact
  • Compliance tracking that reads the same evidence pack across NIST SP 800-161r1, NIST CSF 2.0 (the GOVERN function on supply chain risk), NIST SP 800-53 SR family, ISO 27001 Annex A 5.19 to 5.23 (information security in supplier relationships), SOC 2 CC9.2 (vendor and business partner risk), and the EU CRA and DORA Article 28 disclosure expectations
  • Activity log with CSV export that captures every state change to a supplier record, an assessment, a contract, a finding, or a residual risk acceptance, so an internal auditor or external auditor can reconstruct the operating cadence without a multi-team excavation
  • AI report generation that turns the operating record into a board-ready C-SCRM progress summary, a supplier-facing assessment summary, and an audit-pack narrative without rewriting the underlying record
  • Team management with role-based access (owner, admin, member, viewer, billing) that keeps procurement, legal, vendor risk, security, and business owners on the same workspace with appropriate scoping per tier and per business line

The Tier 3 evidence (component inventory, vulnerability triage, residual risk acceptance, retest closure) reads against operational workflows that already exist as named use cases. The dependency vulnerability triage workflow translates SCA findings into the per-finding queue SR-3 expects. The vulnerability acceptance and exception management workflow carries the residual-risk acceptance trail SR-2 and SR-6 read against. The cross-framework control mapping workflow reads the same evidence pack across 800-161r1, NIST CSF 2.0, ISO 27001, SOC 2, and the EU CRA and DORA disclosure expectations, so the cross-regime read is reconcilable rather than reconciled per audit. The audit evidence retention and disposal workflow carries the lifecycle the SR-12 component disposal control reads against and the SBOM-versioning the SR-4 provenance control inherits from.

For internal security teams running the C-SCRM baseline, the internal security teams workspace bundles the platform with the engagement structure the audit cadence reads against. For GRC and compliance teams managing the cross-regime supply chain evidence, the GRC and compliance teams workspace covers the policy hierarchy, the evidence pack, and the audit cadence the framework expects. For CISOs and security leaders carrying the Tier 1 C-SCRM strategy, the CISOs and security leaders workspace covers the program-level reporting model that sits on top of the C-SCRM operating record.

For deeper reading on the disciplines this framework reads against, the CISA Secure Software Development Attestation guide covers the procurement-side instrument that operationalises the C-SCRM expectations for software the federal government acquires. The VEX guide covers the supply-chain transparency artefact paired with SBOM that closes the consumer-side exploitability question 800-161r1 references but does not prescribe. The third-party vendor risk assessment guide covers the supplier-side discipline SR-6 reads against. The NIST CSF 2.0 framework page covers the GOVERN function on supply chain risk and the SR-aligned subcategories the cross-walk reads against. For analytical context on how the supply chain side ages across compliance cycles, the security control drift research covers the patterns that erode C-SCRM evidence between annual reviews when the audit is run only at announcement time.

Key control areas

SecPortal helps you track and manage compliance across these domains.

Tier 1: Enterprise C-SCRM strategy

Tier 1 sits at the enterprise level and is owned by senior leadership. The C-SCRM strategy names the supply chain risk appetite, the integration with the enterprise risk management programme, the cross-functional governance roles (legal, procurement, IT, security, business owners), the C-SCRM policy hierarchy, and the executive accountability. The strategy is the artefact a board, an audit committee, or a federal customer reads against to confirm the programme exists rather than is assumed.

Tier 2: Mission and business process C-SCRM plan

Tier 2 sits at the mission and business process level. The C-SCRM plan translates the Tier 1 strategy into the operating posture for a defined business line, mission, or product family. It names the criticality classification of the supply chain elements, the supplier categorisation, the C-SCRM control tailoring per supplier tier, the contract clauses, the assessment cadence, and the integration with procurement and vendor management. The plan is the artefact procurement, vendor risk, and product owners read against day to day.

Tier 3: System-level C-SCRM

Tier 3 sits at the system level. It applies the C-SCRM controls (the SR family in NIST SP 800-53 Rev. 5 plus the supply chain enhancements across the other control families) to a specific system or service. The system C-SCRM evidence carries the supplier inventory for the system, the SBOM-aligned component inventory, the SLSA-aligned build provenance where applicable, the supplier security questionnaire results, the assessment record for high-criticality components, and the residual risk acceptance per supplier and per component class.

The SR control family in NIST SP 800-53 Rev. 5

The Supply Chain Risk Management (SR) family in NIST SP 800-53 Rev. 5 is the operating control set the 800-161 framework reads against. Twelve baseline controls (SR-1 Policy and Procedures, SR-2 Supply Chain Risk Management Plan, SR-3 Supply Chain Controls and Processes, SR-4 Provenance, SR-5 Acquisition Strategies and Tools, SR-6 Supplier Assessments and Reviews, SR-7 Supply Chain Operations Security, SR-8 Notification Agreements, SR-9 Tamper Resistance and Detection, SR-10 Inspection of Systems or Components, SR-11 Component Authenticity, SR-12 Component Disposal) plus the C-SCRM enhancements that 800-161r1 layers on the other families form the operating record. The SR family is the named anchor; the rest of the controls inherit C-SCRM context where the supply chain dimension applies.

C-SCRM artefact set

The artefact set the framework expects is enumerated rather than implied: the C-SCRM strategy and policy at Tier 1, the C-SCRM plan at Tier 2, the system-level C-SCRM evidence at Tier 3, the supplier inventory and tiering, the supplier risk assessments and reviews, the contract language carrying the security and resilience expectations, the SBOM-aligned component inventory, the provenance and integrity evidence (signing, attestations, SLSA-aligned build records), the supplier notification agreements (vulnerability disclosure expectations, breach notification clocks), and the disposal and replacement records for retired components and suppliers.

Integration with enterprise risk management

NIST SP 800-161r1 is explicit that C-SCRM is a sub-discipline of enterprise risk management. The C-SCRM strategy is integrated with NIST SP 800-39 (Managing Information Security Risk) and the C-SCRM controls are applied through NIST SP 800-37 (Risk Management Framework). For a federal customer or a regulated enterprise, this means the supply chain risk register, the supplier inventory, the assessment record, and the residual risk acceptance read into the same enterprise risk record the rest of the cyber programme writes to. Standalone supply chain registers that do not reconcile with the enterprise risk record are a documented anti-pattern.

NIST SP 800-161r1 vs SLSA, SSDF, SBOM, and EU CRA

NIST SP 800-161r1 is the strategy-and-controls layer. SLSA is the build-integrity scaffold. SSDF (NIST SP 800-218) is the secure software development practices catalogue. SBOM (SPDX or CycloneDX) is the component inventory artefact. EU CRA is the regulation that obliges manufacturers placing products with digital elements on the EU market to maintain the supply chain artefacts. The publications stack rather than compete: 800-161r1 names the strategy, the SR controls, and the integration; SSDF names the development practices; SLSA names the build attestations; SBOM names the component inventory; CRA names the regulatory consequence. Programmes that operate against multiple regimes use 800-161r1 as the strategy spine and read the rest of the artefact set against it.

C-SCRM evidence the audit reads against

Internal auditors, external auditors, federal customers under FedRAMP and NIST SP 800-171, financial regulators under DORA Article 28, and EU market surveillance under CRA all read C-SCRM evidence in similar shapes. The minimum durable pack is the C-SCRM strategy and policy with the version history, the C-SCRM plan per business line, the supplier tiering with the criticality assignment, the supplier assessment record (questionnaires, on-site reviews where applicable, attestations), the SBOM and the component inventory at point in time, the build provenance for first-party components, the contract language with the security and resilience expectations, the breach and vulnerability notification log, and the residual risk acceptance per high-criticality supplier. The pack is structured rather than narrative; reconstruction at audit time is the failure mode the framework was published to address.

Related features

Vulnerability management software that tracks every finding

Compliance tracking without a full GRC platform

Find vulnerabilities before they ship

Repository connections for SAST and SCA

Test web apps behind the login

Monitor continuously catch regressions early

Document management for every security engagement

Every action recorded across the workspace

Run a defensible C-SCRM programme on one record

Hold the supplier inventory, the SBOM-aligned component record, the build provenance, the assessment evidence, and the residual risk acceptance on one workspace, then read the same record across NIST 800-161r1, SLSA, SSDF, SBOM, and EU CRA. Start free.

Get Started Free

No credit card required. Free plan available forever.