NIST SP 800-161 Rev. 1 is NIST's guidance on cybersecurity supply chain risk management, or C-SCRM. It is long and written for large organizations. A small team can take a few ideas from it: manage supplier risk at several levels, tie it to your wider risk work, and write policy before you need it.
What it is
NIST published SP 800-161 Rev. 1, "Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations," in May 2022, replacing the 2015 version. Its abstract says it provides guidance on identifying, assessing and mitigating cybersecurity risks throughout the supply chain at all levels of an organization.
The NIST page I fetched also states that the May 2022 publication was withdrawn on 1 November 2024 and superseded by an updated version of Rev. 1. If you cite it, link the current version from NIST, and check the status yourself.
The problem it describes
The abstract notes that organizations have less visibility into how the technology they buy is developed and deployed. That exposes them to malicious functionality, counterfeits and vulnerabilities from poor development practices. That is the same worry behind every vendor review.
The multilevel idea
NIST describes a multilevel approach that folds supply chain risk management into the wider risk process: organization level, mission or business process level, and system level. For a small team this translates simply:
- Organization. Write down your risk appetite for suppliers and who decides. See writing a risk appetite statement.
- Business process. For each process that depends on a supplier, note what happens if it fails.
- System. For each system, list the suppliers and components it depends on.
What to adopt first
- A supplier inventory with owners and tiers. See how to tier vendors.
- A short supplier security policy: what you require before buying and how you review.
- Contract language for breach notice, subprocessors and audit rights.
- Software component visibility: an SBOM or dependency inventory for what you ship.
- An exit plan for critical suppliers.
What to leave for later
Full control catalogs, formal assessment cycles for every supplier and detailed counterfeit controls. Those make sense in large or regulated programs.
How to use it without drowning
Read the introduction and the sections on risk management levels. Treat the control catalog as a menu. Pick a handful that match your biggest supplier risks and record why you left the rest.
If your customers ask whether you follow it, answer accurately. Using ideas from the guidance is not the same as conforming to it. Safeguard's SBOM and dependency scanning can supply the component inventory, with a free scan at https://gold.safeguard.sh/scan.
Quick check
Is NIST SP 800-161 mandatory for private companies?
It is guidance. Some contracts or programs may reference it, so check your own obligations.
Where should a small team start?
With a supplier inventory, tiers and basic contract terms. The rest can follow your risk.
Sources
Last reviewed: 19 October 2026.
