Manage NIST 800-161 Level 2 supply chain risk by programme

NIST 800-161 Level 2 is the mission and business process level of the multilevel C-SCRM approach in NIST SP 800-161 Rev. 1. Level 1 sets enterprise strategy and policy, Level 2 applies it to specific programmes, missions and business functions, and Level 3 covers operational systems. At Level 2, programme and business owners identify supply chain dependencies, prioritise critical functions and build C-SCRM requirements into acquisitions.

Level 2 is owned by mission and business process leaders, such as programme managers, business owners, acquisition and contracting staff, and the security and risk specialists who support them. They take the enterprise C-SCRM strategy from Level 1 and turn it into programme-specific requirements, supplier criticality decisions and contract clauses, which then guide system-level work at Level 3.

NIST SP 800-161 is guidance rather than law. US federal agencies are expected to manage supply chain risk and commonly use it to do so, and they can pass its requirements to contractors and suppliers through contracts. For commercial organisations it is voluntary, though customers in the public sector or critical industries may ask suppliers to show they follow it.

Appendix A of SP 800-161 Rev. 1 lists C-SCRM controls based on NIST SP 800-53 Rev. 5 and marks the level or levels at which each applies. The Level 2 selection spans all 20 control families, with notable weight in program management, supply chain risk management, system and services acquisition, configuration management and access control. Always confirm the selection against the latest NIST text.

The Level 2 controls are SP 800-53 Rev. 5 controls with added supply chain guidance, so organisations already working to 800-53 have a strong head start. ISO 27001 covers supplier relationships in its Annex A controls, and much of the same evidence, such as supplier assessments, contract security terms and asset inventories, supports both. Mapping controls once avoids collecting it twice.

No. There is no official certification scheme for NIST SP 800-161. Organisations implement the guidance and demonstrate it through their own risk management records, agency assessments or contract reviews. Third-party assessors can review your C-SCRM practices, but any report is an attestation of your programme rather than a NIST certificate.

SP 800-161r1-upd1, dated 1 November 2024, is an errata update to the May 2022 Revision 1 rather than a new revision. NIST says it clarifies guidance on topics such as vulnerability advisory reports and software bills of materials, and corrects errors including control enhancement numbering. The changes are listed in Appendix K of the updated publication.

Yes, on request. NIST 800-161 Level 2 is mapped in OneClickComply's control library and can be enabled for your organisation. Its controls link to evidence you already collect for frameworks such as NIST 800-53, ISO 27001 and SOC 2, and you can manage supplier risk through our vendor risk management, risk register and Ask an Auditor service.