Meet NIST 800-161 flow-down controls your customers require
The NIST 800-161 flow-down controls are the 69 cyber supply chain risk management (C-SCRM) controls that NIST SP 800-161 Rev. 1 says prime contractors should implement and pass on to relevant sub-tier contractors. They are a subset of the publication's C-SCRM baseline, drawn from NIST SP 800-53 Rev. 5. Customers use them to set the security requirements written into supplier contracts.
Is NIST 800-161 flow-down right for your organisation?
You will usually meet these controls as a supplier or subcontractor, when a US federal agency or prime contractor writes them into a contract or supplier security schedule. NIST's guidance tells enterprises to require their prime contractors to implement each flow-down control and pass it down to relevant sub-tier contractors, so they can reach several tiers into a supply chain. Buyers outside government also use the list as a ready-made set of supplier requirements.
It is usually required by customers, partners or schemes rather than by law.
- Issued by
- National Institute of Standards and Technology (NIST)
- Source publication
- NIST SP 800-161 Rev. 1, Appendix B C-SCRM control summary
- Published
- May 2022, with Update 1 issued on 1 November 2024
- Number of flow-down controls
- 69 controls and enhancements across 20 control families
- Applies to
- Prime contractors and their relevant sub-tier contractors, through contract terms
- Assessment route
- No certification; customers assess suppliers against contract terms, typically using SP 800-53A assessment methods
- Type
- Guidance (contractual)
- Region
- United States, US
- In OneClickComply
- Supported today
OneClickComply makes it simple
NIST 800-161 flow-down controls are mapped in OneClickComply's control library and available on request, so you can see which of the 69 controls your existing evidence already meets. Evidence collected once from your connected tools counts towards the flow-down set and frameworks such as ISO 27001 and SOC 2. Our trust centre and security questionnaire automation then help you show customers how you meet the requirements they flow down.
Requirements covered
69 controls and control enhancements across all 20 NIST SP 800-53 Rev. 5 control families, flagged in the Flow Down Control column of the C-SCRM control summary in Appendix B of SP 800-161 Rev. 1.
Manual NIST 800-161 flow-down vs. OneClickComply
- Reading over 300 pages of NIST guidance to work out which controls your customer actually expects from you
- Translating each 800-53 control into evidence that a supplier of your size can realistically produce
- Gathering logs, configuration exports and access reviews by hand every time a customer asks
- Flowing the same requirements down to your own subcontractors with spreadsheets and email
- Answering long supply chain security questionnaires from scratch for each contract
- A clear list of the 69 flow-down controls mapped to what you already do
- Controls mapped across frameworks, so ISO 27001 or SOC 2 evidence counts here too
- Evidence collected automatically from your connected tools and kept current
- Vendor risk management to track your own sub-tier suppliers in one place
- Questionnaire automation and a trust centre that reuse your evidence for every customer
Everything you need for NIST 800-161 flow-down
Mapping of all 69 NIST 800-161 flow-down controls to your existing controls, available on request
Automated evidence for access, logging, configuration and vulnerability controls from connected tools
AutoComplete policies covering access control, incident response, personnel and maintenance
Continuous monitoring that alerts you when a flow-down control drifts
Vendor risk management to pass the same requirements on to your own sub-tier suppliers
Trust centre and questionnaire automation to answer customer supply chain reviews
Three steps to NIST 800-161 flow-down compliance
Connect & scan
Connect your cloud, identity and SaaS tools. OneClickComply checks them against NIST 800-161 flow-down and shows you exactly where you stand.
Fix & generate
OneClickFix remediates technical gaps in one click, and AutoComplete generates NIST 800-161 flow-down-aligned policies from your real environment.
Monitor & evidence
Continuous monitoring keeps you compliant, and our in-house audit team is on hand when you need expert guidance.
NIST SP 800-161 Rev. 1 Flow-Down Controls requirements
All 69 controls and enhancements that NIST SP 800-161 Rev. 1 flags as flow-down controls in its Appendix B C-SCRM control summary, with their NIST SP 800-53 Rev. 5 titles.
| Reference | Requirement |
|---|---|
| AC-1 | Access Control Policy and Procedures |
| AC-2 | Account Management |
| AC-3 | Access Enforcement |
| AC-4 | Information Flow Enforcement |
| AC-5 | Separation of Duties |
| AC-17 | Remote Access |
| AC-20 | Use of External Systems |
| AC-23 | Data Mining Protection |
| AC-24 | Access Control Decisions |
| AT-2(2) | Literacy Training and Awareness: Insider Threat |
| AT-3 | Role-based Training |
| AU-2 | Event Logging |
| AU-3 | Content of Audit Records |
| AU-12 | Audit Record Generation |
| AU-13 | Monitoring for Information Disclosure |
| AU-14 | Session Audit |
| AU-16(2) | Cross-organisational Audit Logging: Sharing of Audit Information |
| CA-3 | Information Exchange |
| CM-2 | Baseline Configuration |
| CM-3 | Configuration Change Control |
Always check the official NIST 800-161 flow-down text for the exact wording.
NIST 800-161 flow-down FAQs
What are the NIST 800-161 flow-down controls?
They are the 69 controls that NIST SP 800-161 Rev. 1 identifies as ones prime contractors should implement and flow down to relevant sub-tier contractors. They are flagged in the Flow Down Control column of the C-SCRM control summary in Appendix B, and each is based on a NIST SP 800-53 Rev. 5 control, such as AC-2 account management, IR-6(3) supply chain coordination and SR-3(3) sub-tier flow down.
Who has to comply with NIST 800-161 flow-down requirements?
Only organisations that agree to them in a contract. NIST SP 800-161 is guidance, but US federal agencies and prime contractors can write the flow-down controls into contracts with suppliers, and those suppliers are then expected to pass them on to relevant subcontractors. Commercial buyers may also adopt them as part of their supplier security requirements.
How are flow-down controls different from the C-SCRM baseline?
The flow-down controls are a narrower set. The C-SCRM baseline in SP 800-161 Rev. 1 covers the controls an enterprise should implement itself, while the flow-down designation marks the 69 controls NIST says should also be required of prime contractors and their relevant sub-tier contractors. Some flow-down controls, such as AC-4 and AC-5, are not in the C-SCRM baseline.
What happens if a supplier does not meet the flow-down controls?
The consequences are contractual rather than regulatory. NIST does not issue fines or certificates for SP 800-161. A customer that has written the controls into a contract may treat a gap as a breach of contract, require a remediation plan, rate the supplier as higher risk or decide not to award or renew work, depending on the contract terms.
How do I comply with NIST 800-161 flow-down controls?
Start by confirming exactly which controls your contract requires, then map them to your existing security controls and fix the gaps. Write or update policies for access control, incident response, personnel security and maintenance, collect evidence for each control, and include the same requirements in contracts with your own relevant subcontractors, as SR-3(3) expects. Keep evidence current for customer reviews.
How do the flow-down controls relate to ISO 27001 and SOC 2?
They overlap substantially. Most flow-down controls, such as account management, event logging, configuration management, incident response and encryption, have close equivalents in ISO 27001 Annex A and the SOC 2 trust services criteria. An ISO 27001 or SOC 2 programme gives you much of the evidence, but supply chain specific controls like IR-6(3), RA-3(1) and SR-3(3) usually need extra attention.
Is there a certification for NIST 800-161?
No. There is no official NIST 800-161 certification or accredited certification scheme. Suppliers demonstrate conformance through contract attestations, customer assessments, security questionnaires or independent assessments, which often follow the assessment procedures in NIST SP 800-53A. Be cautious of any provider that claims to issue an official NIST 800-161 certificate.
Does OneClickComply support NIST 800-161 flow-down controls?
Yes, on request. The NIST 800-161 flow-down controls are mapped in OneClickComply's control library and available on request rather than live as a standard framework today. Because controls are mapped across frameworks, evidence you collect for ISO 27001, SOC 2 or NIST 800-53 also counts towards the flow-down set. Contact us to enable it for your account.
Related standards
All standards- NIST SP 800-82 Rev. 3Guidance · US
- NIST SP 800-171A Rev. 3Guidance · US
- NIST SP 800-82 Rev. 3 High OT OverlayGuidance · US
- NIST SP 800-82 Rev. 3 Moderate OT Overlay BaselineGuidance · US
- NIST SP 800-171AGuidance · US
- NIST SP 800-161 Rev. 1Guidance · US
- NIST SP 800-161 Rev. 1 Level 3 (Operational C-SCRM)Guidance · US
- NIST AI 600-1 Generative AI ProfileGuidance · US
Products that power NIST 800-161 flow-down compliance
Get NIST 800-161 flow-down ready, not stressed
Automate controls, gather evidence continuously and stay audit-ready, all on one platform.