Lead supply chain risk from the top with NIST 800-161 Level 1

NIST 800-161 Level 1 is the enterprise level of the three-level C-SCRM approach in NIST SP 800-161 Rev. 1. At this level senior leaders form governance structures, frame supply chain cyber risk and set the C-SCRM strategy, policy and high-level implementation plan. These outputs guide how C-SCRM is tailored at Level 2 (mission and business process) and carried out at Level 3 (operational).

The three levels follow the enterprise risk management hierarchy. Level 1 (enterprise) sets strategy, policy, governance and risk tolerance. Level 2 (mission and business process) tailors those outputs into C-SCRM plans and requirements for each mission or business process. Level 3 (operational) applies C-SCRM to individual systems, products and acquisitions. Appendix A of SP 800-161 Rev. 1 tags each control with the levels it applies to.

Appendix A of SP 800-161 Rev. 1 assigns 80 SP 800-53 Rev. 5 controls and enhancements to Level 1. They include the policy and procedures control in each family, program management controls such as PM-9 risk management strategy, PM-28 risk framing and PM-30 supply chain risk management strategy, and supply chain controls SR-1, SR-3, SR-5 and SR-11.

NIST SP 800-161 Rev. 1 is guidance developed under FISMA for US federal agencies, which use it to build their C-SCRM programmes. NIST states it may be used by non-governmental organisations on a voluntary basis. Private companies usually meet it because a federal customer or prime contractor asks for evidence of mature supply chain risk management, not because a law applies to them directly.

Executive leadership. NIST says ownership of supply chain cyber risk ultimately lies with the head of the organisation, with an executive board or enterprise risk management council evaluating risk across the enterprise. A C-SCRM council, often led by the CIO or CISO, develops the enterprise C-SCRM strategy, and a C-SCRM programme management office can coordinate activity across the organisation.

Level 1 is built on NIST SP 800-53 Rev. 5 controls with added supply chain guidance, so organisations using 800-53 already have much of the structure. ISO 27001 overlaps on leadership, policy, risk assessment and supplier relationship controls. Mapping one control set across all three means governance evidence such as policies, risk decisions and supplier reviews can be reused rather than produced three times.

No. NIST does not run a certification or accreditation scheme for SP 800-161. Federal agencies implement it through their own risk management and authorisation processes, and suppliers demonstrate alignment through contract requirements, supplier assessments and security questionnaires. Independent assessments can help show maturity, but no body issues an official NIST 800-161 certificate.

Yes, on request. NIST 800-161 Level 1 is mapped in OneClickComply's control library and available on request. Once enabled, you can use AutoComplete policy generation, the risk register, vendor risk management and continuous monitoring against the Level 1 controls, with evidence shared across other frameworks such as NIST 800-53 and ISO 27001. OneClickComply does not issue certifications.