SR-5 asks you to employ acquisition strategies, contract tools and procurement methods, chosen by you, to protect against, identify and mitigate supply chain risks. NIST 800-53 binds US federal systems and, by contract, some others. For other companies it is a prompt to use buying power as a security control instead of treating procurement as paperwork.
What it asks
The statement names no specific method. You select the strategies, tools and methods, so the test is whether you picked sensible ones, applied them in real purchases and can show it.
What it means in practice
NIST's guidance says the acquisition process is an important vehicle for protecting the supply chain. It lists techniques such as obscuring the end use of a component, blind or filtered buys, tamper evident packaging and trusted or controlled distribution. The results of a supply chain risk assessment should guide which methods fit.
It also lists softer tools that suit software buyers well: incentives for suppliers who implement controls and are transparent about their practices, contract language that prohibits tainted or counterfeit components, restrictions on purchases from untrustworthy suppliers, training for personnel on supply chain risk, and protecting development plans and documentation, with contracts specifying documentation protection requirements.
For a company buying SaaS, open source support or contractor services, that becomes a checklist in the buying process. What security evidence do you require before signing? What does the contract say about breach notice, subcontractors and audit rights? What happens if the supplier fails an assessment?
The two enhancements are adequate supply (SR-5.1) and assessments prior to selection, acceptance, modification or update (SR-5.2). The second one fits software well. Assess before you adopt and before you accept a major update.
Evidence to collect
- A procurement procedure that includes security and supply chain checks.
- Intake questionnaires and review results for selected suppliers.
- Contract templates and executed contracts with the security clauses you rely on.
- A record of decisions to reject or restrict a supplier.
- Training or briefing records for the people who buy.
- Risk assessment results that informed which methods were used.
Common gaps
- Security reviews that start after the purchase order is signed.
- Contract terms negotiated by procurement without security input.
- Different standards for small purchases, which is where tool sprawl starts.
- No rule for restricting untrustworthy suppliers.
- Single supplier dependence with no plan if they fail.
How to implement it
Put security into the front of the buying process. A short intake form triggers a review proportional to the risk of the purchase.
Define a standard clause set: breach notification, subcontractor disclosure, evidence of controls, right to assess, and termination support. Keep it short enough to get signed.
Tier your purchases. A tool with production access gets a deeper review than one that handles no data. Record the tier and the reasoning.
Keep a rejected list. It proves the process has teeth, and it saves you repeating reviews.
Connect it to SR-6 for ongoing supplier reviews and SR-8 for notification terms, so the contract, review and incident path line up.
Quick check
Is SR-5 only for physical goods?
No. The tools in the guidance, such as contract language and supplier incentives, apply equally to software and services.
What does SR-5.2 add?
An assessment before you select, accept, modify or update a system, component or service, so risk is considered before commitment.
