- ClassificationCategorySupply Chain SecurityDomainSupply Chain SecurityFramework FamilyNIST Special Publications
- Regulatory ContextTypeGuidanceLegal InstrumentGuidelineSectorCross-SectorIndustryCross-Industry
- Region / PublisherRegionGlobalRegion DetailUnited StatesPublisherNational Institute of Standards and Technology (NIST)
- VersioningVersionRevision 1 (May 2022; Update 1 of November 1, 2024)Effective DateMay 5, 2022Issue DateMay 5, 2022 (Rev. 1); updated November 1, 2024
- AdoptionAdoption ModelVoluntaryImplementation ComplexityHigh
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
NIST SP 800-161 Rev. 1 is free of charge from NIST; the Level 1 guidance is Sec. 2.3.2 and Appendices D.1 and D.2 of the same publication.
Framework text is licensed by its publisher and is included only where stated above.
- Level 1 of NIST SP 800-161 Rev. 1 is the enterprise level where senior leaders set the tone and direction for C-SCRM.
- Executives provide an overarching C-SCRM strategy, a C-SCRM policy, and a high-level implementation plan.
- Level 1 stakeholders are the CEO, CIO, COO, CFO, CISO, and the chief technology, acquisition, privacy, and risk officers.
- They frame risk for the enterprise, set its risk appetite, form governance structures, and form a C-SCRM program management office.
- Ownership of supply chain cybersecurity risk lies with the head of the organization, who delegates to authorizing officials.
Overview
This page covers Level 1, the enterprise level, of NIST SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations; the publication as a whole is described on the NIST SP 800-161 Rev. 1 page. Level 1 is where senior leaders set the tone and direction for cybersecurity supply chain risk management (C-SCRM) across the enterprise by providing an overarching C-SCRM strategy, a C-SCRM policy and a high-level implementation plan (Sec. 2.3.2). NIST published Revision 1 on May 5, 2022, replacing the April 8, 2015 edition, and issued Update 1 on November 1, 2024. Federal agencies must use NIST's C-SCRM guidelines by statute; every other organization adopts them voluntarily.
The Level 1 stakeholders in Table 1 are executive leadership: the CEO, CIO, COO, CFO, CISO, chief technology officer, chief acquisition officer, chief privacy officer and chief risk officer. Their activities are to define the enterprise C-SCRM strategy, form governance structures and an operating model, frame risk for the enterprise and set its risk appetite, define the high-level implementation plan, policy, goals and objectives, make enterprise-level C-SCRM decisions and form a C-SCRM program management office (PMO). Ownership and accountability for cybersecurity risks in the supply chain lie with the head of the organization, who delegates to authorizing officials and, through them, to designated officials who manage risk day to day (Sec. 2.3.2).
Level 1 outputs, the strategy, the policy and the governance and operating model, are tailored at Level 2 to each mission and business process and applied to individual systems in C-SCRM plans at Level 3 (Fig. 6 and Fig. 7). Appendix D supplies templates for the C-SCRM Strategy and Implementation Plan (D.1) and the C-SCRM Policy (D.2), Appendix A tags each C-SCRM control with the levels at which it applies, and Table 4 in Sec. 3.5 lists the measurement topics that belong to Level 1.
Why does it matter?
Sec. 2.3.2 states the case for Level 1 in one sentence: without executive oversight of C-SCRM activities, enterprises are limited in their ability to make risk decisions across the organization about how to secure their products and services. Level 1 is where that oversight is created. It designates an executive-level individual, office or group to lead agency-wide supply chain risk management, chooses between a centralized model that relies on a C-SCRM PMO and a decentralized one, makes the enterprise's risk assumptions and appetite explicit, and secures the dedicated, recurring funding that Sec. 3.6 says must be built into the strategy and the budget.
Key benefits include:
- Named executive ownership
The head of the organization owns supply chain cybersecurity risk, and an executive-level individual, office or group is designated to lead agency-wide SCRM activities whatever the organizational structure (Sec. 2.3.2).
- Three documents that bind the lower levels
The C-SCRM Strategy, the C-SCRM Policy and the High-Level Implementation Plan shape and constrain how C-SCRM is carried out at Level 2 and Level 3 (Sec. 2.3 and Fig. 6).
- Explicit risk framing
Level 1 states the enterprise's assumptions about threats, vulnerabilities, impact and likelihood, its constraints, its risk appetite and tolerance, and its priorities and trade-offs, which become the inputs to the strategy (Sec. 2.3.2 and Appendix G.2.1).
- A governance model that fits the enterprise
Sec. 2.3.2 allows centralized authority with a C-SCRM PMO consolidating resource-intensive tasks such as vendor risk assessments, or decentralized authority where business processes are autonomous.
- Enterprise-wide reporting
Level 1 reports cover the extent of C-SCRM implementation, its effectiveness and conditions needing urgent attention; Table 4 names policy adoption at lower levels, adherence to risk appetite and tolerance statements and compliance with regulatory mandates as Level 1 measures.
How does it work?
Governance comes first. Sec. 2.3.2 describes an executive board that evaluates and mitigates all enterprise risks through an enterprise risk management (ERM) council drawing on the CEO, chief risk officer, CIO, chief legal officer or general counsel, CISO and chief acquisition officer. The CIO or CISO may form a C-SCRM council to give that ERM council deeper analysis; the C-SCRM council develops the enterprise-wide strategy, which makes the ERM council's assumptions, constraints, risk tolerances and priorities explicit. C-SCRM is integrated into enterprise risk management through the CIO's and CISO's membership of the ERM council, and C-SCRM roles are defined for the senior leaders in acquisition and procurement, information security, IT, legal, program management, and supply chain and logistics.
The documents follow. The C-SCRM Strategy and Implementation Plan (Appendix D.1) anchors to the enterprise risk management strategy and may be one document or several; its template runs from purpose, authority and compliance and strategic objectives through an implementation plan with progress tracking, roles and responsibilities, definitions and a version management table (D.1.1.1 to D.1.1.7, Table 17). The C-SCRM Policy (Appendix D.2) establishes the program's purpose, outlines responsibilities, defines and grants authority to C-SCRM roles across the enterprise and sets out compliance and enforcement expectations (Sec. 2.3.2, D.2.1.1 to D.2.1.6). Leaders are also expected to establish a C-SCRM PMO or another dedicated function and to name the lead roles at the mission and business process level.
Level 1 then feeds the other levels and is fed by them. Outputs from Level 1 are tailored and refined within Level 2 to fit each mission and business process, and Level 1 outputs are iteratively updated from the results produced below (Sec. 2.3.2). Level 1 risk assessments either test the exposure of enterprise objectives to threats arriving through supply chain products or services, or aggregate and recontextualize the assessments completed at Level 2. Appendix G.2 explains that the Frame, Assess, Respond and Monitor cycle is used primarily at Levels 1 and 2 to set the risk context, while the Risk Management Framework operates mainly at Level 3.
Key Elements
- C-SCRM Strategy and High-Level Implementation Plan
The Level 1 document that dictates how the enterprise plans to assess, respond to and monitor supply chain cybersecurity risk, with a plan to guide execution; template in Appendix D.1 with milestone tables (Tables 14 to 16).
- C-SCRM Policy
Establishes the program's purpose, responsibilities, delegated authority and compliance and enforcement expectations; template in Appendix D.2 with a version management table (Table 18).
- Governance structure and operating model
Defines authority, responsibility and decision-making power for C-SCRM: an ERM council, an optional C-SCRM council, and a centralized, decentralized or hybrid model (Sec. 2.3.2 and 2.3.5).
- Risk framing
The Level 1 Frame step records assumptions, constraints, appetite and tolerance, priorities and trade-offs that guide C-SCRM decisions enterprise-wide (Sec. 2.3.2, Appendix G.2.1).
- C-SCRM PMO
A central office that may draft the strategy and policy on delegation, guide Level 1 stakeholders through risk framing, manage the C-SCRM risk register, liaise with the FASC and brief the risk executive and board (Sec. 2.3.5).
- Level 1 controls in Appendix A
Each control carries a Level(s) tag; PM-9 Risk Management Strategy is tagged Level 1 alone, PM-30 Supply Chain Risk Management Strategy Levels 1 and 2, and SR-1, SR-3, SR-5, SR-11, RA-3 and SA-4 all three levels (Appendix A, Table 5 format, Table 6 summary).
- Level 1 measurement topics
Table 4 lists policy adoption at lower levels and its timeliness, adherence to risk appetite and tolerance statements, differentiated risk exposure across Level 2, compliance with regulatory mandates and adherence to customer requirements (Sec. 3.5).
- Dedicated resources
Sec. 3.6 asks enterprises to identify resource needs and secure adequate, recurring, dedicated funding through the strategy and the budgeting, investment review and funds management processes.
What does it cover?
Level 1 covers the enterprise as a whole: the executive leadership roles in Table 1, the ERM and C-SCRM owners and operators of Sec. 1.4.1, for whom NIST recommends the entire document, and the enterprise, agency and mission owners of Sec. 1.4.2. The publication applies to federal agencies, which by statute must use NIST's C-SCRM guidelines, and Appendix E adds agency-specific guidance under Section 1326(a)(1) of the Federal Acquisition Supply Chain Security Act, which requires executive agencies to assess the supply chain risk of covered articles and respond to it. Any other enterprise may apply Level 1 voluntarily; footnote 20 to Table 1 notes that small and mid-sized businesses may see less differentiation among stakeholders.
What are its objectives?
Sec. 2.3.2 and Table 1 give Level 1 the following objectives:
Set the tone and direction for enterprise-wide C-SCRM through an overarching strategy, a policy and a high-level implementation plan (Sec. 2.3.2).
Designate an executive-level lead for agency-wide SCRM and define C-SCRM roles for senior leaders in acquisition, information security, IT, legal, program management and supply chain and logistics.
Frame risk for the enterprise: make assumptions, constraints, appetite and tolerance, priorities and trade-offs explicit so that the strategy and the lower levels can rely on them.
Decide the governance structure and operating model, form a C-SCRM PMO or dedicated function, and delegate decisions to Levels 2 and 3 (Table 1).
Prioritize enterprise-wide resource allocation and secure dedicated, recurring funding (Sec. 2.3.2 and 3.6).
Report on enterprise-wide trends and update Level 1 outputs with what Levels 2 and 3 learn (Sec. 2.3.2).
Framework in Context
The three levels and the Frame, Assess, Respond and Monitor cycle come from NIST SP 800-39 (Sec. 2.3). Level 1 hands its outputs to the Level 2 mission and business process page and, through it, to the Level 3 operational page, where the Risk Management Framework of SP 800-37 applies. Appendix A is an enhanced overlay of SP 800-53 Rev. 5; Sec. 2.3.2 points Level 1 readers to its SR-1, SR-3, PM-2, PM-6, PM-7, PM-9 and PM-28 to PM-31. Appendix E covers the Federal Acquisition Supply Chain Security Act; Appendix F moves the Executive Order 14028 software guidance online. Update 1 of November 1, 2024 replaced CSF 1.1 references with CSF 2.0 and added RA-3(1) (Appendix K).
Common Framework Mappings
The Level 1 strategy and policy sit beside the frameworks an enterprise already reports against, so the mapping list below shows where one governance record can serve several programs.
Mapped frameworks include:
CIS Controls v8.1
COBIT 2019
FedRAMP Rev. 5
ISACA Risk IT
ISO 27001:2022
ISO/IEC 27036
NIST CSF 2.0
NIST 800-37 Rev.2
NIST 800-53 Rev.5
PCI DSS 4.0.1
How SmartSuite Supports NIST SP 800-161 Rev. 1 (Level 1)
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Enterprise Risk Management to hold the Level 1 risk framing and the strategy's objectives and milestones, Compliance Management to publish the C-SCRM policy and track its adoption by each mission and business process, and Internal Audit Management to review whether the lower levels follow the constraints Level 1 set.
Strategy and Implementation Plan Record
Keep the Appendix D.1 sections as fields: purpose, authority and compliance, strategic objectives, implementation milestones with owners and dates (Tables 14 to 16), roles, definitions and the version table.
C-SCRM Policy Register
Hold the Appendix D.2 policy with its authority, policy statements, delegated roles, compliance and enforcement expectations and revision history, and record each lower-level policy that implements it.
Risk Framing Statements
Use Enterprise Risk Management to record the assumptions, constraints, risk appetite and tolerance statements, priorities and trade-offs of the Level 1 Frame step so Levels 2 and 3 tailor from one source (Sec. 2.3.2).
Governance and Role Map
Record the ERM council, the C-SCRM council, the designated executive lead and the C-SCRM PMO, with the Level 1 roles for acquisition, information security, IT, legal, program management and supply chain and logistics.
Level 1 Measures Dashboard
Report the Table 4 Level 1 topics: policy adoption at lower levels and its timeliness, adherence to appetite and tolerance statements, risk exposure across Level 2 and compliance with regulatory mandates.
Level 1 Control Set
Load the Appendix A controls tagged Level 1, such as PM-9, PM-30, SR-1, SR-3, SR-5, SR-11, RA-3 and SA-4, into Compliance Management with owners, status and evidence, using the Table 6 summary as the index.
Related frameworks
CIS Controls v8.1 is a prioritized set of 18 Controls and 153 Safeguards, in three Implementation Groups, with a new Govern function.
ISO/IEC 27001:2022 specifies requirements for an information security management system: Clauses 4 to 10, risk treatment, the Statement of Applicability and 93 Annex A controls.
ISO/IEC 27002:2022 is the reference set of 93 information security controls in four themes, with attributes and implementation guidance, that supports an ISO/IEC 27001 ISMS.
NIST CSF 2.0 (CSWP 29, February 26, 2024) is the voluntary cybersecurity framework with six Functions including Govern, 22 Categories, 106 Subcategories, Profiles and Tiers.
NIST SP 800-37 Rev. 2 is the NIST Risk Management Framework: seven steps from Prepare to Monitor, with the tasks, roles and authorization decisions federal agencies apply under OMB A-130.
Frequently Asked Questions For NIST SP 800-161 Rev. 1 (Cybersecurity Supply Chain Risk Management Practices)
Level 1 is the enterprise level of the three-level structure NIST SP 800-161 Rev. 1 takes from SP 800-39. Sec. 2.3.2 says it sets the tone and direction for enterprise-wide C-SCRM by providing an overarching C-SCRM strategy, a C-SCRM policy and a high-level implementation plan, forms the governance structures through which executives make C-SCRM decisions, and frames risk for the enterprise. Its outputs shape and constrain how C-SCRM is carried out at Level 2 and Level 3.
Table 1 lists executive leadership: the CEO, CIO, COO, CFO, CISO, chief technology officer, chief acquisition officer, chief privacy officer and chief risk officer. Sec. 2.3.2 adds that ownership and accountability lie with the head of the organization, that an executive-level individual, office or group should be designated to lead agency-wide SCRM, and that an ERM council, often with a supporting C-SCRM council formed by the CIO or CISO, is where enterprise risk decisions are made.
Three: the C-SCRM Strategy, the C-SCRM Policy and the High-Level Implementation Plan (Sec. 2.3 and Fig. 6). Appendix D.1 gives a template for the strategy and implementation plan, which may be a single document or several, and Appendix D.2 gives a template for the policy. Sec. 2.3.2 also expects Level 1 to define the governance structure and operating model and to establish a C-SCRM PMO or another dedicated function.
For federal agencies, yes in substance: NIST's C-SCRM program states that by statute agencies must use NIST's C-SCRM and other cybersecurity guidelines, and Appendix E explains the Federal Acquisition Supply Chain Security Act duty to assess and respond to supply chain risk. For every other organization the publication is voluntary guidance. It is not a certification scheme, and acquirers are told in Appendix A not to write requirements such as "ensure compliance with NIST SP 800-161, Rev. 1 controls" but to select the controls relevant to the acquisition.
Level 1 outputs are tailored and refined within Level 2 to fit each mission and business process, and Level 2 outputs in turn shape the C-SCRM plans written for individual systems at Level 3 (Sec. 2.3.2 and 2.3.3). The flow is bidirectional: Level 1 outputs are updated from results at the lower levels. Appendix G.2 adds that the Frame, Assess, Respond and Monitor cycle is used primarily at Levels 1 and 2, while the Risk Management Framework of SP 800-37 operates predominantly at Level 3.
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.