Put NIST 800-161 Level 3 supply chain controls to work on every system

NIST 800-161 Level 3 is the operational level of the three-level C-SCRM approach in NIST SP 800-161 Rev. 1. It is where cyber supply chain controls are selected, implemented, assessed and monitored for individual systems, components and services, guided by the strategy set at Level 1 (enterprise) and the priorities set at Level 2 (mission and business process).

The three levels describe where C-SCRM activity happens. Level 1 is the enterprise level, covering strategy, governance, policy and risk appetite. Level 2 is the mission and business process level, which translates that strategy into priorities and programmes. Level 3 is the operational level, where those decisions become controls for specific systems throughout their development life cycle and operation.

Level 3 controls are mainly the responsibility of system owners and the people around each system: engineers, developers, security staff, acquisition and contracting officers, and operations teams. In US federal agencies they are documented in the system security plan or a system-level C-SCRM plan, and suppliers often support them through contract requirements.

No, SP 800-161 Rev. 1 is NIST guidance rather than law, and there is no certification. US federal agencies use it to meet their supply chain risk management obligations, so it can become a contractual requirement for suppliers when an agency writes its controls into a contract. Non-federal organisations adopt it voluntarily as good practice.

Level 3 uses the C-SCRM controls in SP 800-161 Rev. 1 that are designated for the operational level. They are based on NIST SP 800-53 Rev. 5 and span families such as Supply Chain Risk Management (SR), System and Services Acquisition (SA), Configuration Management (CM), Access Control (AC), Contingency Planning (CP) and Incident Response (IR), tailored for supply chain risk.

Level 3 controls are built on NIST SP 800-53 Rev. 5, adding supply chain guidance to existing controls and a small number of new C-SCRM controls, so an 800-53 programme gives a strong starting point. ISO 27001 overlaps through its supplier relationship and secure development controls, but it is far less detailed on system-level supply chain risk.

It depends on how many systems are in scope, how mature your SP 800-53 controls already are, and how much supplier information you hold. Organisations with established configuration management, asset inventories and vendor risk processes move faster, because much of the Level 3 evidence comes from controls they already operate.

Yes, on request. NIST SP 800-161 Rev. 1 Level 3 is mapped in OneClickComply's control library and available on request rather than live by default. Once enabled, evidence collected for overlapping controls, such as NIST SP 800-53 configuration, access and logging controls, counts towards it, alongside vendor risk management and policy generation.