The Supply Chain Risk Management family, SR, is the 20th family in NIST SP 800-53 Rev. 5. A software vendor is most likely to be asked about SR-2 (the plan), SR-3 (controls and processes), SR-4 (provenance), SR-5 (acquisition methods) and SR-11 (component authenticity).
The controls in plain language
SR-2, Supply Chain Risk Management Plan. A plan for managing supply chain risk across research, design, acquisition, delivery, operations and disposal of defined systems and components. It must be reviewed and protected from unauthorized change.
SR-3, Supply Chain Controls and Processes. A process to find and address weaknesses in supply chain elements, with selected controls to limit harm from supply chain events, all documented.
SR-4, Provenance. Document, monitor and maintain valid provenance of defined systems, components and data. The control describes provenance as the chronology of origin, development, ownership, location and changes.
SR-5, Acquisition Strategies, Tools, and Methods. Use contract and procurement tools to protect against supply chain risk.
SR-11, Component Authenticity. An anti-counterfeit policy and procedures that detect and prevent counterfeit components, with reporting. The discussion names CISA among external reporting bodies.
Which baseline
In the Rev. 5 baseline profiles checked for this post, SR-2, SR-3, SR-5, SR-8, SR-11 and SR-12 appear in low, moderate and high. SR-6 appears in moderate and high, and SR-9 in high only. SR-4 is not selected by any baseline, but a program can add it.
What a software vendor can show
- SR-2. A concrete artifact: A short written plan naming suppliers, owners and review dates
- SR-3. A concrete artifact: A process for assessing new dependencies and a record of decisions
- SR-4. A concrete artifact: Build records, signed artifacts and an SBOM tied to each release
- SR-5. A concrete artifact: Contract clauses and intake checks for suppliers
- SR-11. A concrete artifact: Verification of packages against their source and registry before use
How this relates to SP 800-161
NIST SP 800-161 Rev. 1 is the dedicated guidance. Its abstract says it covers products and services that may contain malicious functionality, be counterfeit or be vulnerable due to poor development practices. It describes a multilevel approach with strategy plans, policies, plans and risk assessments. Use 800-53 for the control wording and 800-161 for how to build the program behind it.
Start small
You do not need a large program on day one. Write a one page plan, list your top suppliers and open source dependencies, and decide what you check before adding one. Review it twice a year or when something changes.
Try it yourself
Open the demo and click a package to see its origin, the kind of record SR-3 and SR-4 conversations start from.
Click through it at your own pace, or open it full screen.
Quick check
Is SR-4 provenance in the low baseline?
Not in the Rev. 5 baseline profile checked here. A program can still select it.
Where do I learn how to build the program, not just the control?
NIST SP 800-161 Rev. 1 is the dedicated supply chain risk management guidance.
Safeguard's SBOM and dependency scanning and its policies and gates give a software team practical records for SR-3 and SR-4 style questions. A free scan is at gold.safeguard.sh/scan.
Sources
- NIST SP 800-53 Rev. 5 catalog and baseline profiles, SR family (OSCAL content)
- NIST SP 800-161 Rev. 1
- NIST SP 800-53 Rev. 5 page
Last reviewed: 19 October 2026.
