SR-6 asks you to assess and review the supply chain related risks of suppliers or contractors, and of the system, component or service they provide, at a frequency you define. NIST 800-53 binds US federal systems and, by contract, some others. For other companies it is the closest match to what buyers call vendor risk management, so it is worth knowing.
What it asks
The statement is one sentence. You decide how often and how deep. What matters is that supplier risk is assessed before reliance and reviewed afterward, and that both are recorded.
What it means in practice
NIST says a supplier assessment includes the supplier's security and supply chain risk management processes, foreign ownership, control or influence, and the supplier's ability to assess its own second tier and third tier suppliers. Reviews can be done by you or by an independent third party. They consider documented processes, documented controls, all source intelligence and publicly available information.
The guidance adds that open source information can be used to monitor for signs of stolen information, poor development and quality control practices, information spillage or counterfeits. In some cases it may be appropriate or required to share results with other organizations under applicable rules or agreements.
In a commercial setting, a supplier review usually looks like this: collect their security documentation, read audit reports and certifications they hold, ask about subcontractors, check public incident history, and look at the software they ship. For a software supplier, that last part can be tested. SR-6.1 covers testing and analysis, which is the enhancement that moves you from reading claims to checking them.
Do not take a supplier's claims at face value, and do not overstate them either. A vendor holding a given certification is a fact to verify against the report, not a statement you repeat to your own customers without checking.
Evidence to collect
- The supplier register with a risk tier for each.
- The assessment method per tier and the review frequency.
- Completed questionnaires, collected reports and review notes.
- Decisions and conditions, including accepted risks and required fixes.
- Evidence of fourth party consideration, such as subcontractor lists.
- Records of ongoing monitoring: advisories, breach news, changes in ownership.
- Results of testing and analysis of delivered software or components, where applicable.
Common gaps
- One time onboarding review, with no scheduled follow up.
- Questionnaires collected but nobody reads the answers.
- No view of subcontractors.
- Review depth identical for every supplier, so critical ones are under reviewed.
- Findings noted with no owner or deadline.
- No check of the actual software a supplier delivers.
How to implement it
Start with a register and tiers. Critical suppliers touch production, hold sensitive data or sit in your build chain. Everyone else gets a lighter review.
Define the review per tier: what you collect, who reads it and how often. Critical suppliers might be reviewed yearly and after any incident. Lower tiers every two years.
Record decisions as well as documents. A review that ends with "accepted, with these conditions, until this date" is evidence. A folder of PDFs is not.
Monitor between reviews. Subscribe to supplier security notices and watch for public incidents.
For software you receive, test it. Scan the packages and components you ship or consume for known vulnerabilities, and record the result in the supplier file.
Click through it at your own pace, or open it full screen.
Quick check
Can a third party perform the SR-6 review?
Yes. The guidance says reviews may be conducted by the organization or by an independent third party.
Why does SR-6 mention second and third tier suppliers?
Because your supplier's suppliers are part of your risk. The assessment should consider whether your supplier can manage them.
