Current Edition Checked October 24, 2026
Federal agencies use it to manage cybersecurity supply chain risk, and flow its expectations down to suppliers.
What It Covers
How to identify, assess and respond to cybersecurity risks throughout the supply chain, at the enterprise, mission and operational levels.
Who It Applies To
Federal agencies and their suppliers, and any organization managing cybersecurity risk in what it buys.
Key Requirements
- A cybersecurity supply chain risk management (C-SCRM) strategy, policy, and plan.
- Supplier risk assessment, including software and component provenance.
- Controls tailored from NIST SP 800-53 for the supply chain.
- Information sharing and incident handling with suppliers.
What an Auditor Asks to See
- The C-SCRM plan and how critical suppliers were assessed.
Where Systems Fall Short
- Supplier questionnaires collected and never scored.
How QES Helps
Through QES’s risk and cybersecurity partner, joined to the quality system’s supplier controls.
Related Standards
Sources. NIST — SP 800-161 Rev. 1 (opens in a new tab). Status checked October 24, 2026. This page summarizes NIST SP 800-161 Rev. 1; it does not reproduce or replace it. Buy the standard from its publisher, or read the regulation in its official text, before relying on a detail. Not legal advice.