Cyber Supply Chain Risk Management (C-SCRM) — NIST SP 800-161

Federal agencies and primes now treat the supply chain as part of your security. They want to know which suppliers, software, and hardware your work depends on, what risk each one carries, and what you do about it. NIST SP 800-161 is the federal standard for answering that, and it goes well past a vendor questionnaire.

We start by mapping what matters: the suppliers, components, and services your critical systems and contracts rely on. We assess each one for the risk it brings — where it comes from, who has access, what happens if it fails or is compromised — and record the results in a supply chain risk register.

From there we write the C-SCRM strategy and plan, the policies, and the supplier requirements you flow down to your own subcontractors, and we set up the routine for reassessing suppliers as contracts change. For federal systems, the work lines up with the supply chain controls in NIST SP 800-53 so it feeds your authorization package. Onsite review is scoped in the proposal when it is needed.

Who it's for

• Federal primes and subcontractors asked to show a C-SCRM plan
• Defense suppliers that flow security requirements down to their own vendors
• Agencies and system owners working through NIST SP 800-53 supply chain controls

Call (888) 753-6725. Calls answered 24/7, 365 days a year.