Put the C-SCRM Baseline in place with evidence that maps itself
The C-SCRM Baseline is the set of 95 security controls and control enhancements that NIST SP 800-161 Rev. 1 identifies as the starting point for cyber security supply chain risk management. It is flagged in the C-SCRM control summary table in the publication's appendix, which takes the NIST SP 800-53 Rev. 5 low baseline as relevant to supply chain risk and adds further supply chain controls, such as the SR family. Organisations then tailor it using NIST SP 800-53B.
Is C-SCRM Baseline right for your organisation?
US federal agencies use the C-SCRM Baseline when building C-SCRM plans and selecting controls for systems they acquire, and it often reaches suppliers through contract clauses. Technology vendors, managed service providers and defence or government contractors adopt it to show buyers they manage supply chain risk. Any organisation starting a supply chain security programme can use it as a defined minimum.
Adopting it is voluntary, though customers and auditors often expect it.
- Issued by
- National Institute of Standards and Technology (NIST)
- Source publication
- NIST SP 800-161 Rev. 1, C-SCRM control summary (Appendix B)
- Published
- May 2022, updated 1 November 2024 (SP 800-161r1-upd1)
- Baseline size
- 95 controls and enhancements across 19 families
- Built from
- NIST SP 800-53 Rev. 5 low baseline plus added supply chain controls
- Status
- Voluntary guidance, often required through US federal contracts
- Assessment route
- No certification; self-assessment or third-party assessment against SP 800-53A
- Type
- Guidance (voluntary)
- Region
- US
- In OneClickComply
- Supported today
OneClickComply makes it simple
The C-SCRM Baseline is mapped in OneClickComply's control library and available on request, so each of the 95 controls links to the evidence and policies you already hold for other frameworks. Automated evidence collection, vendor risk management and continuous monitoring cover much of the baseline's access, configuration, logging and supplier controls. Our in-house audit team can advise on tailoring and gaps.
Requirements covered
95 SP 800-53 Rev. 5 controls and enhancements across 19 control families, marked as the C-SCRM Baseline in the C-SCRM control summary of NIST SP 800-161 Rev. 1, including 10 Supply Chain Risk Management (SR) controls and enhancements.
Manual C-SCRM Baseline vs. OneClickComply
- Cross-referencing 95 controls between SP 800-161 and SP 800-53 by hand
- Chasing suppliers for evidence over email and spreadsheets
- Writing 19 separate policy and procedure documents from scratch
- Screenshots and exports that go stale before an assessment
- No clear view of which baseline controls are drifting or failing
- Controls mapped once, with evidence reused across SP 800-53 and other frameworks
- Supplier assessments and records held in one vendor risk workspace
- Policies generated from your real environment and ready to tailor
- Evidence collected automatically from connected tools and admin consoles
- Live control status, with drift alerts and one-click fixes where supported
Everything you need for C-SCRM Baseline
All 95 C-SCRM Baseline controls mapped to your existing controls
Vendor risk management for supplier assessments and notification agreements
Automated evidence for access, logging and configuration controls
AutoComplete policies covering the baseline's policy and procedure controls
Risk register for supply chain risk assessment and risk response
Continuous monitoring with alerts when baseline controls drift
Three steps to C-SCRM Baseline compliance
Connect & scan
Connect your cloud, identity and SaaS tools. OneClickComply checks them against C-SCRM Baseline and shows you exactly where you stand.
Fix & generate
OneClickFix remediates technical gaps in one click, and AutoComplete generates C-SCRM Baseline-aligned policies from your real environment.
Monitor & evidence
Continuous monitoring keeps you compliant, and our in-house audit team is on hand when you need expert guidance.
NIST SP 800-161 Rev. 1 C-SCRM Baseline requirements
All 95 controls and enhancements marked as the C-SCRM Baseline in the NIST SP 800-161 Rev. 1 C-SCRM control summary, using SP 800-53 Rev. 5 identifiers and names, with family policy controls named by family.
| Reference | Requirement |
|---|---|
| AC-1 | Access Control Policy and Procedures |
| AC-2 | Account Management |
| AC-3 | Access Enforcement |
| AC-17 | Remote Access |
| AC-18 | Wireless Access |
| AC-19 | Access Control for Mobile Devices |
| AC-20 | Use of External Systems |
| AC-22 | Publicly Accessible Content |
| AT-1 | Awareness and Training Policy and Procedures |
| AT-2(2) | Literacy Training and Awareness | Insider Threat |
| AT-3 | Role-based Training |
| AT-4 | Training Records |
| AU-1 | Audit and Accountability Policy and Procedures |
| AU-2 | Event Logging |
| AU-3 | Content of Audit Records |
| AU-6 | Audit Record Review, Analysis, and Reporting |
| AU-12 | Audit Record Generation |
| CA-1 | Assessment, Authorization, and Monitoring Policy and Procedures |
| CA-2 | Control Assessments |
| CA-3 | Information Exchange |
Always check the official C-SCRM Baseline text for the exact wording.
C-SCRM Baseline FAQs
What is the NIST SP 800-161 C-SCRM baseline?
The C-SCRM baseline is a set of 95 NIST SP 800-53 Rev. 5 controls and enhancements that NIST SP 800-161 Rev. 1 marks as the starting point for cyber security supply chain risk management. It appears in the publication's C-SCRM control summary table, alongside columns for flow-down controls and the enterprise levels where each control applies. It covers areas from access control and incident response to supply chain controls such as component authenticity.
How many controls are in the C-SCRM baseline?
The C-SCRM baseline contains 95 controls and control enhancements across 19 NIST SP 800-53 families. These include policy and procedure controls for each family, core controls such as account management, configuration settings and flaw remediation, and 10 Supply Chain Risk Management (SR) controls and enhancements, including SR-11 Component Authenticity with its anti-counterfeit training and configuration control enhancements.
How is the C-SCRM baseline different from the SP 800-53 low baseline?
The C-SCRM baseline starts from the SP 800-53 Rev. 5 low baseline, which NIST SP 800-161 Rev. 1 treats as relevant to supply chain risk, and adds further controls to form a supply chain specific set. Additions include PM-30 Supply Chain Risk Management Strategy, RA-3(1) Supply Chain Risk Assessment and SI-7 Software, Firmware, and Information Integrity. Organisations then tailor it to their own risk.
Is the C-SCRM baseline mandatory?
No, the C-SCRM baseline is voluntary NIST guidance. In practice, US federal agencies use SP 800-161 Rev. 1 to shape their supply chain risk programmes, and they may write its controls into contracts, which makes them binding on the supplier. Commercial organisations adopt it by choice, often because customers ask for evidence of supply chain risk management.
How does the C-SCRM baseline relate to flow-down controls?
They are separate markings in the same table. The C-SCRM baseline is the starting set an organisation implements itself, while flow-down controls are those NIST says should pass from prime contractors to relevant sub-tier contractors. Many controls carry both markings, such as AC-2 Account Management and SR-10 Inspection of Systems or Components, but the two lists are not identical.
How does the C-SCRM baseline relate to ISO 27001?
Both cover access control, incident response, configuration and supplier relationships, so much of the evidence overlaps. ISO 27001 is a certifiable management system standard with supplier controls in Annex A, while the C-SCRM baseline is a US control set with no certification. Organisations holding ISO 27001 usually find a large share of the baseline already addressed, with supply chain specifics such as component authenticity left to add.
How long does it take to implement the C-SCRM baseline?
It depends on your starting point. An organisation already operating SP 800-53, FedRAMP or ISO 27001 controls can reuse much of its existing evidence and focus on the supply chain additions. One starting from scratch has to build policies, supplier processes and technical controls across 19 families. Prioritising by risk, as SP 800-161 recommends, keeps the effort manageable.
Does OneClickComply support the C-SCRM baseline?
Yes, on request. The C-SCRM baseline is mapped in OneClickComply's control library and available on request rather than live as a standard framework today. Once enabled, its 95 controls link to your existing evidence, policies, vendor records and risks, and our in-house audit team can help you tailor the baseline. OneClickComply does not issue certifications for it.
Related standards
All standards- NIST SP 800-82 Rev. 3Guidance · US
- NIST SP 800-171A Rev. 3Guidance · US
- NIST SP 800-82 Rev. 3 High OT OverlayGuidance · US
- NIST SP 800-82 Rev. 3 Moderate OT Overlay BaselineGuidance · US
- NIST SP 800-171AGuidance · US
- NIST SP 800-161 Rev. 1Guidance · US
- NIST SP 800-161 Rev. 1 Level 3 (Operational C-SCRM)Guidance · US
- NIST AI 600-1 Generative AI ProfileGuidance · US
Get C-SCRM Baseline ready, not stressed
Automate controls, gather evidence continuously and stay audit-ready, all on one platform.