NIST SP 800-161 Rev. 1 (Level 2)

Why does it matter?

Level 2 is where an enterprise's supply chain exposure becomes concrete. Sec. 2.3.3 observes that risk exposure arises from primary dependencies on suppliers and from secondary dependencies on individual systems or other processes, for example a single supplier whose components serve several systems on which critical processes depend, and that non-traditional sources such as open source software may escape C-SCRM processes unless policies and controls address them. Level 2 is also where risk tolerance and common control baseline decisions are typically set before being tailored to systems at Level 3, so a missing Level 2 leaves Level 3 without the context it needs and Level 1 without a view of process-level exposure.

Key benefits include:

• Process-specific strategy, policy and plan

Mission areas and business lines generate their own tailored strategy and implementation plan within the constraints of the enterprise strategy and in conformance with enterprise policy (Sec. 2.3.3).

• Program requirements with C-SCRM built in

Cost, schedule, performance and security requirements, plus reliability, dependability, safety and quality, are defined and managed at Level 2 (Sec. 2.3.3).

• Earlier vulnerability reduction

Table 1 assigns Level 2 the task of reducing vulnerabilities at the onset of new IT projects and related acquisitions, and of reviewing the system, human and organizational flaws that expose business, technical and acquisition environments.

• Risk tolerances set once, used twice

Level 2 tailors the enterprise risk framework by setting risk tolerances and may define common control baselines that Level 3 then applies to individual systems (Table 1 and Sec. 2.3.3).

• Measured performance

Table 4 names the Level 2 measurement topics: effectiveness of mitigation strategies, time allocation across C-SCRM activities, process-level risk exposure, the degree and quality of requirement adoption, and use of a C-SCRM PMO by Level 3 (Sec. 3.5).

How does it work?

Level 2 begins by tailoring the enterprise's C-SCRM frame to the threats, vulnerabilities, impacts and likelihoods of a specific mission or business process (Sec. 2.3.3). Informed by the Level 1 strategy, the process adopts its own strategy, may issue process-specific policies that contextualize the enterprise policy, and develops a C-SCRM implementation plan as a detailed roadmap for operationalizing the strategy. That plan specifies roles, responsibilities, implementation milestones, dates and the processes for monitoring and reporting, and Appendix D offers templates for the strategy, implementation plan and policy. NIST suggests a committee with representation from each mission and business process to coordinate the work and build an enterprise and C-SCRM architecture.

Acquisition is the main channel through which Level 2 acts on the supply chain. Sec. 3.1.1 asks for a current inventory of supplier relationships, contracts and the products and services they provide, grouped into categories such as strategic or innovative, mission-critical, sustaining and standard or non-essential, so attention goes to the suppliers that matter most. Sec. 3.1.2 then walks through the procurement life cycle from IR 7622: plan procurement, define requirements, perform market analysis, complete procurement, ensure compliance and monitor performance. The plan procurement and requirements steps are typically led by the mission and business process owner with the procurement official, and NIST advises against lowest price, technically acceptable source selection for ICT/OT products and services.

Assessment and reporting close the loop. Level 2 activities assess, respond to and monitor the risk exposure arising from the process's dependencies on suppliers, developers, system integrators and service providers (Sec. 2.3.3). Where a C-SCRM PMO exists, Sec. 2.3.5 says it may supply starter kits with a base strategy, policies, procedures and guidelines, consult as process-specific strategies and implementation plans are written, advise on or develop common control baselines, and perform supplier and product risk assessments. Level 2 reporting mirrors Level 1 topics reshaped for the process and includes metrics that compare process performance with the enterprise's risk appetite and tolerance statements; the outputs feed Level 3 and iteratively refine Level 1.

Key Elements

• Mission and business process C-SCRM strategy

A tailored strategy that applies the enterprise strategy to one process and stays within its constraints and policies (Sec. 2.3.3; Appendix D.1 template).

• C-SCRM implementation plan

The process-level roadmap naming roles, responsibilities, milestones, dates and monitoring and reporting processes (Sec. 2.3.3; Appendix D.1.1.4 implementation plan and progress tracking).

• Process-specific policies and procedures

Policies, procedures, guidance and constraints that contextualize the enterprise policy for the process (Table 1; Appendix D.2 template).

• Supplier inventory and segmentation

The inventory of supplier relationships, contracts, products and services, mapped into strategically relevant groupings (Sec. 3.1.1); control SR-13 Supplier Inventory is new in this publication and tagged Levels 2 and 3.

• Supplier assessments and reviews

Due diligence, requests for information, sources sought notices and questionnaires in market analysis, and procurement-specific supplier risk assessments at proposal review (Sec. 3.1.2); control SR-6 is tagged Levels 2 and 3.

• Level 2 controls in Appendix A

Controls tagged for Level 2 include PM-30 Supply Chain Risk Management Strategy (Levels 1 and 2), PM-2, PM-32 Purposing, SR-4 Provenance, SR-6, SR-7, SR-8 Notification Agreements, SR-12 Component Disposal, SR-13 and CM-8 System Component Inventory (Levels 2 and 3).

• Risk tolerance and common control baselines

Decisions typically made at Level 2 and then tailored and applied to individual systems at Level 3 (Sec. 2.3.3).

• Level 2 reporting and measures

Reports to Level 1 that reflect Level 1 topics reshaped for the process, with the Table 4 measurement topics and metrics against appetite and tolerance statements (Sec. 2.3.3 and 3.5).

What does it cover?

Level 2 covers each mission and business process of the enterprise and the business management roles in Table 1 that own it. Sec. 1.4.2 addresses enterprise, agency and mission and business process owners and operators and points them to Sections 1, 2, 3.3, 3.4 and 3.6 and Appendices A, B and E; Sec. 1.4.3 addresses acquisition and procurement owners and operators and adds Sections 2.1, 2.2 and 3.1 and Appendix F, telling them to pay special attention to the controls that belong in agreements with prime and sub-tier contractors. Federal agencies must use NIST's C-SCRM guidelines by statute; other enterprises apply Level 2 voluntarily.

What are its objectives?

Sec. 2.3.3 and Table 1 give Level 2 these objectives:

Develop a mission and business process-specific C-SCRM strategy, policies, procedures, guidance and constraints within the limits Level 1 set (Table 1).

Define and manage program requirements for cost, schedule, performance, security, reliability, dependability, safety and quality (Sec. 2.3.3).

Reduce vulnerabilities at the onset of new IT projects and related acquisitions, and review the flaws that expose business, technical and acquisition environments to cyber threats (Table 1).

Develop C-SCRM implementation plans with roles, milestones, dates and monitoring and reporting processes (Sec. 2.3.3).

Tailor the enterprise risk framework to the process by setting risk tolerances, and manage risk within the process (Table 1).

Form or collaborate with a C-SCRM PMO, report on C-SCRM to Level 1 and act on reporting from Level 3 (Table 1).

Framework in Context

Level 2 sits between the Level 1 enterprise page, whose strategy and policy it tailors, and the Level 3 operational page, whose C-SCRM plans it shapes. The levels come from NIST SP 800-39; Appendix G.2 says the Frame, Assess, Respond and Monitor cycle runs primarily at Levels 1 and 2 while the SP 800-37 Risk Management Framework operates mainly at Level 3, with Level 2 criticality determinations informing system categorization below. Sec. 2.3.3 points Level 2 readers to SR-1, SR-3, SR-6, PM-2, PM-6, PM-7 and PM-30 to PM-32 of SP 800-53 Rev. 5. Update 1 of November 1, 2024 deleted Table 3-1 on C-SCRM in the procurement process and added RA-3(1) as a flow-down and baseline control (Appendix K).

Common Framework Mappings

The Level 2 supplier inventory, assessments and contract requirements overlap with what other frameworks ask of supplier management, so the mapping list below shows where one process-level record can serve several programs.

Mapped frameworks include:

CIS Controls v8.1

COBIT 2019

FedRAMP Rev. 5

ISO 27001:2022

ISO/IEC 27036

NIST CSF 2.0

NIST 800-53 Rev.5

NIST 800-171 Rev. 3

SOC 2

Cyber Essentials