NIST SP 800-161 Rev. 1 (Level 3)

Why does it matter?

Level 3 is where the enterprise's supply chain decisions reach a running system. Sec. 2.3.4 says Level 3 activities manage the operational risk exposure from any ICT/OT-related product or service in use by the enterprise or within a system's authorization boundary, starting with an analysis of the likelihood and impact of a supply chain threat exploiting an operational-level vulnerability in a system or component. The C-SCRM plan is the critical Level 3 activity, and NIST is explicit that it is a living document to be referenced regularly and refreshed periodically, not a document written to satisfy a compliance requirement.

Key benefits include:

• A plan per system

C-SCRM plans dictate how C-SCRM is integrated into every SDLC phase of a system: acquisition, requirements, architectural design, development, delivery, installation, integration, maintenance and disposal or retirement (Sec. 2.3.4).

• Risk responses chosen, not assumed

After determining risk, Level 3 evaluates alternative courses of action, accept, avoid, mitigate, share or transfer, and responds by selecting, tailoring, implementing and monitoring C-SCRM controls through the SDLC under the RMF (Sec. 2.3.4).

• Inherited and system-specific controls

Selected C-SCRM controls are usually a combination of common controls inherited from Levels 1 and 2 and information system-specific controls at Level 3 (Sec. 2.3.4).

• Tactical reporting for system owners

Level 3 reporting covers implementation, efficiency, effectiveness and the system's exposure, giving system owners insight to make rapid adjustments, with metrics against the appetite and tolerance statements of all three levels (Sec. 2.3.4).

• Shared assessment services

Where a C-SCRM PMO exists, product risk assessments can be provided as a centralized shared service, and Appendix D.4 says the cybersecurity supply chain risk assessment is typically executed by PMOs at Level 3.

How does it work?

The C-SCRM plan comes first. Sec. 2.3.4 lists its contents: applicable security control information plus information on the system, its categorization, operational status, related agreements, architecture, critical system personnel, related laws, regulations and policies, and the contingency plan. Appendix D.3 adds that the plan is implementation-specific, may stand alone or form part of the system security and privacy plan with its C-SCRM components clearly discernible, applies to high- and moderate-impact systems under FIPS 199, and is tailored so it can determine whether a technology, service, component or system is fit for purpose. The D.3.1 template runs from system identifier through categorization, inventory, connections, control details, roles, contingencies and approval.

Risk assessment follows the Appendix D.4 template. The cybersecurity supply chain risk assessment guides the review of any third-party product, service or supplier that could present a cybersecurity risk to the procurer, and its template is a toolbox of questions an acquirer uses or skips depending on the controls selected. It opens with authority and compliance and a description, then information gathering and scoping analysis built on the Table 26 questionnaire, released as a fillable form on December 2, 2025, and continues through threat, vulnerability, impact and risk response analysis (D.4.1.1 to D.4.1.7). NIST notes that assessments must be designed to run at scale with templated workflows and that their rigor should match their priority.

The Risk Management Framework ties the work together. Appendix G.2 explains that the Frame, Assess, Respond and Monitor cycle used at Levels 1 and 2 feeds the RMF, which operates predominantly at Level 3 through its seven steps of Prepare, Categorize, Select, Implement, Assess, Authorize and Monitor; Level 1 and Level 2 assumptions enter at the Prepare step and are tailored through each successive step to fit the system or procurement. Aggregated Level 3 outputs flow back to update the assumptions made above. Sec. 2.3.4 points Level 3 readers to SR-1, SR-2, SR-6, PL-2, PM-31 and PM-32 of SP 800-53 Rev. 5.

Key Elements

• C-SCRM plan

The implementation-specific plan for one system covering management, implementation assurance and monitoring of C-SCRM controls across the SDLC, including controls applicable to contractors (Sec. 2.3.4; Appendix D.3 template; control SR-2 is tagged Level 3).

• System security plan integration

Appendix A guidance on PL-2, tagged Level 3, lets the enterprise write a stand-alone C-SCRM plan or integrate SCRM controls into the system security plan, coordinated with suppliers, developers and integrators.

• Cybersecurity supply chain risk assessment

The Appendix D.4 review of a third-party product, service or supplier with threat, vulnerability, impact and risk response analysis; Table 26 is its information gathering and scoping questionnaire.

• SDLC coverage

Research and development, design, manufacturing, delivery, integration, operations and maintenance, and disposal or retirement (Sec. 1.5 and 2.3.4); Appendix A guidance on PL-1 says Level 3 must cover the full SDLC from the C-SCRM perspective.

• Level 3 controls in Appendix A

SR-2 Supply Chain Risk Management Plan and PL-2 are tagged Level 3 only; CM-8 System Component Inventory, SR-4 Provenance, SR-6 Supplier Assessments and Reviews, SR-10 Inspection of Systems or Components, SR-12 Component Disposal and SR-13 Supplier Inventory are tagged Levels 2 and 3.

• Risk response and control tailoring

Accept, avoid, mitigate, share or transfer, then select, tailor, implement and monitor controls under the RMF; Appendix A requires tailoring decisions and their rationale to be recorded in the C-SCRM documentation and approved as part of plan approval.

• Level 3 measurement topics

Design effectiveness of controls, operating effectiveness of controls and cost efficiency of controls (Table 4, Sec. 3.5).

• Reporting to Level 2

System-level reports on implementation, efficiency, effectiveness and exposure that inform Level 2 and, through it, refine Level 1 strategies and plans (Sec. 2.3.4 and Table 1).

What does it cover?

Level 3 covers every ICT/OT-related product or service in use by the enterprise or within a system's authorization boundary, and the operational roles listed in Sec. 2.3.4 and Table 1. Sec. 1.4.5 addresses system development, system engineering and system implementation personnel, who execute operational-level C-SCRM activities within their SDLC responsibilities, and recommends Sections 1, 2.1, 2.2 and 2.3.4 and Appendices B, C, F and G; Sec. 1.4.4 adds information security, privacy and cybersecurity operators who conduct risk assessments and select and implement controls. Appendix D.3 states that the C-SCRM plan applies to high- and moderate-impact systems per FIPS 199. Federal agencies must use NIST's C-SCRM guidelines by statute; other enterprises apply Level 3 voluntarily.

What are its objectives?

Sec. 2.3.4 and Table 1 give Level 3 these objectives:

Develop a C-SCRM plan for each system that addresses the management, implementation assurance and monitoring of C-SCRM controls, including those applicable to contractors (Sec. 2.3.4).

Implement the C-SCRM policies and requirements and adhere to the constraints provided by Level 1 and Level 2 (Table 1).

Tailor C-SCRM to the context of the individual system and apply it throughout the SDLC, from acquisition and requirements to disposal or retirement (Table 1 and Sec. 2.3.4).

Assess the likelihood and impact of supply chain threats exploiting operational-level vulnerabilities, informed by Level 1 and Level 2 assessments (Sec. 2.3.4).

Select the risk response and then select, tailor, implement and monitor C-SCRM controls in accordance with the RMF (Sec. 2.3.4).

Maintain the plan as a living document and report on C-SCRM to Level 2 (Sec. 2.3.4 and Table 1).

Framework in Context

Level 3 applies what the Level 1 enterprise page and the Level 2 mission and business process page decide, and it is the level at which the Risk Management Framework of SP 800-37 operates (Appendix G.2); the three levels themselves come from SP 800-39. Appendix A is an enhanced overlay of SP 800-53 Rev. 5, whose SR-2 is the plan control tagged Level 3, and the plan may be folded into the PL-2 system security plan. Update 1 of November 1, 2024 corrected Appendix A control language and numbering and added RA-3(1) (Appendix K). NIST's C-SCRM program lists SP 800-18 Rev. 2, on developing security, privacy and C-SCRM plans for systems, as released on June 30, 2026.

Common Framework Mappings

The system-level C-SCRM plan, component inventory and supplier assessments reuse evidence that other control frameworks also ask for, so the mapping list below shows where one Level 3 record can serve several programs.

Mapped frameworks include:

CIS Controls v8.1

COBIT 2019

FedRAMP Rev. 5

ISO 27001:2022

ISO 27002:2022

NIST CSF 2.0

NIST 800-37 Rev.2

NIST 800-53 Rev.5

PCI DSS 4.0.1

SOC 2