Skip to main content
U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Cybersecurity Supply Chain Risk Management for Systems and Organizations



Jon M. Boyens, Angela Smith, Nadya Bartol, Kris Winkler, Alexander Holbrook, Matthew Fallon


Organizations are concerned about the risks associated with products and services that may contain potentially malicious functionality, are counterfeit, or are vulnerable due to poor manufacturing and development practices within the supply chain. These risks are associated with an enterprise's decreased visibility into, and understanding of, how the technology they acquire is developed, integrated, and deployed, or the processes, procedures, standards, and practices used to ensure the security, resilience, reliability, safety, integrity, and quality of the products and services. This publication provides guidance to organizations on identifying, assessing, and mitigating cybersecurity risks throughout the supply chain at all levels of their organizations. The publication integrates cybersecurity supply chain risk management (C-SCRM) into risk management activities by applying a multilevel, C-SCRM-specific approach, including guidance on development of C-SCRM strategy implementation plans, C-SCRM policies, C-SCRM plans, and risk assessments for products and services.
Special Publication (NIST SP) - 800-161r1
Report Number


C-SCRM, cybersecurity supply chain risk management, acquire, information and communication technology, supply chain, cybersecurity supply chain, supply chain assurance, supply chain risk, supply chain risk assessment, supply chain security, risk management, supplier.


Boyens, J. , Smith, A. , Bartol, N. , Winkler, K. , Holbrook, A. and Fallon, M. (2022), Cybersecurity Supply Chain Risk Management for Systems and Organizations, Special Publication (NIST SP), National Institute of Standards and Technology, Gaithersburg, MD, [online],, (Accessed May 24, 2024)


If you have any questions about this publication or are having problems accessing it, please contact

Created May 5, 2022, Updated November 29, 2022