NIST SP 800-161 Rev. 1 (Flow Down)

Why does it matter?

A federal agency or other enterprise that buys through a prime contractor still carries the risk that sits with the prime's own suppliers. SP 800-161 Rev. 1 does not stop at the first contract: it asks the acquirer to put the requirement in the agreement, require the prime to repeat it downstream, and confirm that it was done. For acquisition and procurement staff, section 1.4.3 calls for special attention to the controls that belong in supplier contracts, and in agreements with both primary and sub-tier contractor parties.

Key benefits include:

• One set of expectations

Section 3.1 says C-SCRM controls that apply across the supply chain give the enterprise a common lexicon and expectations with suppliers and sub-suppliers.

• A marked list of controls

Appendix A selection step 5 identifies controls for flow down to sub-level contractors, and Table 6 in Appendix B carries a Flow Down Control column beside the C-SCRM baseline and level columns.

• Contracts as the vehicle

Section 3.1.2 makes satisfaction of applicable security requirements a qualifying condition for contract award and requires flow-down terms to subcontractors where applicable.

• Sight of upstream suppliers

Control SR-3(3) asks for due diligence on a supplier's upstream dependencies, including fourth- and fifth-party suppliers, before award.

• Revalidation, not one-time checks

Section 3.1.2 calls for periodic revalidation of supplier adherence by certification, site visit, third-party assessment or self-attestation, with rigor matched to criticality.

How does it work?

Selection comes first. Appendix A built its controls in seven steps: extract SP 800-53 Rev. 5 controls, analyze them for C-SCRM, evaluate the set, develop additional controls, identify controls for flow down to relevant sub-level contractors, assign the levels (1, 2 or 3) at which each applies, and write supplemental C-SCRM guidance. Appendix B then lists the result in Table 6, with separate columns for the C-SCRM baseline, flow down controls and levels.

The contract carries the requirement. Section 3.1.2 and control SA-4 have the enterprise set baseline and tailorable C-SCRM requirements and incorporate them in agreements with suppliers, developers, system integrators and external service providers. For each flow down control, the supplemental guidance says the enterprise should require its prime contractors to implement the control and flow the requirement down to relevant sub-tier contractors. SR-3(3), titled Sub-tier Flow Down, says to include the need to flow down controls throughout the life cycle in procurement requirements.

Verification follows through the period of performance. SR-3(3) says suppliers should be monitored for conformance and changes in risk conditions. Section 3.1.2 adds periodic revalidation and agreed processes for reporting vulnerabilities, incidents and business disruptions, including what counts as serious. SR-8 asks suppliers to set up notification agreements with entities in their own chain, and SR-10 puts inspection requirements into supplier contracts and flows them to subcontractors.

Key Elements

• Flow Down Control designation (Appendix B)

Table 6 marks each control that should flow down from prime contractors to relevant sub-tier contractors, next to the C-SCRM baseline and Level 1, 2 and 3 columns.

• The standard instruction (Appendix A)

Require prime contractors to implement the control and flow the requirement down to relevant sub-tier contractors; it recurs in controls such as AC-1, AC-2, CM-2, IA-5, SI-4 and SR-10.

• SR-3(3) Sub-tier Flow Down

Carry controls to subcontractors throughout the life cycle, research upstream dependencies before award and evaluate supplier risk before the award decision.

• SA-4 Acquisition Process

Baseline and tailorable C-SCRM requirements in contracts, covering matters such as intellectual property, end-of-life, secondary-market components and weighted evaluation criteria.

• PM-30 Supply Chain Risk Management Strategy

The strategy and implementation plan at Levels 1 and 2; enterprises require prime contractors to implement it and flow it down. Added as a flow-down and baseline control in Update 1.

• Personnel and access terms (AC-2, PS-3, SA-21)

Unique accounts that do not outlast the contract period, screening incorporated into agreements, and developer screening as a contractual requirement flowed to sub-level subcontractors.

• Supplier assessment and notice (SR-6, SR-8, SR-10)

Consistent baseline assessment factors, notification agreements with entities in the supplier's chain, and inspection requirements written into contracts.

What does it cover?

The flow-down provisions cover the relationships between an enterprise, its prime contractors and their subcontractors and sub-tier suppliers, whether the party is a supplier, developer, system integrator or service provider in the ICT or OT chain. The controls say flow down to relevant sub-tier contractors, and section 3.1.2 says flow-down applies if and when applicable, so the acquirer decides which tiers matter, guided by criticality. Many control entries also direct departments and agencies to Appendix F for the Executive Order 14028 implementation guidance.

What are its objectives?

The flow-down provisions aim to carry the acquirer's C-SCRM expectations through every tier that matters.

Make satisfaction of applicable security requirements a qualifying condition for contract award (section 3.1.2).

Require prime contractors to implement each flow down control and pass it to relevant sub-tier contractors throughout the system development life cycle (SR-3(3)).

Link C-SCRM performance objectives to a method of inspection in a Quality Assurance Surveillance Plan or equivalent.

Revalidate supplier adherence to security requirements periodically, using methods that match the criticality of what is acquired.

Agree how vulnerabilities, incidents and business disruptions are communicated and reported across tiers.

Framework in Context

The flow-down controls sit inside the SP 800-53 Rev. 5 catalog that Appendix A extends: SR-3(3) appears in Table 6 without the asterisk that marks the two controls missing from SP 800-53 (MA-8 and SR-13), so it comes from that catalog. SR-6 sends departments and agencies to Appendix E, on the Federal Acquisition Supply Chain Security Act, for baseline risk factors and the documentation of supplier assessments. Control PL-2 adds a limit: suppliers may not be able to customize to the acquirer's requirements, so the plan for non-federal contractor systems that process federal information is also flowed to sub-level contractors. Table 26 asks whether all sub-tier suppliers have been identified.

Common Framework Mappings

Organizations map the flow-down provisions to the frameworks below so that one set of supplier terms serves several programs.

Mapped frameworks include:

CIS Controls v8.1

FedRAMP Rev. 5

ISO 27001:2022

ISO 27002:2022

NIST CSF 2.0

NIST 800-53 Rev.5

NIST 800-171 Rev. 3

PCI DSS 4.0.1

SOC 2