NIST SP 800-161 Rev. 1 (Level 2) — Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations

Overview

NIST SP 800-161 Rev.1 Level 2 represents the intermediate tier of C-SCRM practices, building on Level 1 foundations with more structured supplier management, formalized risk assessment processes, and integration of supply chain security across organizational functions.

Level 2 applies to organizations with established C-SCRM foundations seeking to mature their supply chain security programs. It covers formalized supplier assessments, documented C-SCRM processes, acquisition security integration, multi-function coordination, and systematic monitoring of supplier security posture.

Organizations at Level 2 implement more rigorous practices including formal supplier security assessments, documented C-SCRM procedures, integration with acquisition and procurement, and systematic monitoring and reporting on supply chain security.

Why it Matters

Level 2 C-SCRM enables organizations to move from basic awareness to systematic supply chain security management with formalized processes and broader organizational integration.

Key benefits include:

• Formalize supplier risk management

Establish documented processes for assessing and managing supplier security risks on an ongoing basis.

• Integrate with acquisition processes

Embed C-SCRM requirements into procurement and acquisition to ensure security is addressed in new technology purchases.

• Establish systematic monitoring

Implement ongoing monitoring of supplier security posture and supply chain risk indicators.

• Build cross-functional coordination

Coordinate C-SCRM activities across procurement, IT, security, and legal functions.

• Meet federal compliance standards

Satisfy intermediate federal requirements for supply chain risk management programs.

How it Works

Level 2 builds on Level 1 with formalized supplier assessment processes, documented C-SCRM procedures, systematic monitoring, and cross-functional coordination. Organizations establish repeatable processes that operate consistently across the supply chain.

Key Elements

• Formal Supplier Assessments

Documented processes for evaluating supplier security practices on a scheduled, systematic basis.

• Documented C-SCRM Procedures

Formalized procedures guiding consistent C-SCRM activities across organizational functions.

• Acquisition Security Integration

Embedded security requirements in procurement and acquisition processes and contracts.

• Systematic Monitoring

Ongoing monitoring of supply chain security indicators and supplier risk posture.

Framework Scope

C-SCRM Level 2 applies to organizations with established C-SCRM foundations implementing more systematic and formalized supply chain security programs.

Framework Objectives

NIST SP 800-161 Rev.1 Level 2 advances C-SCRM from foundational awareness to systematic, formalized supply chain security management.

• Establish formalized supplier assessment processes and documented procedures
• Integrate supply chain security into acquisition and procurement functions
• Implement systematic monitoring of supply chain risks and supplier posture
• Build cross-functional C-SCRM coordination across the organization
• Progress toward advanced C-SCRM capabilities at Level 3

Common Framework Mappings

Mapped frameworks include:

CMMC 2.0

NIST Cybersecurity Framework

NIST SP 800-53

NIST SP 800-171

ISO/IEC 27001