NIST.SP.800-161

Special Publication 800-161
Supply Chain Risk Management Practices for Federal
Information Systems and Organizations
________________________________________________________________________________________________________
1.7.2 Enhanced ICT SCRM Overlay
This publication contains an enhanced overlay of [NIST SP 800-53 Rev. 4]. Chapter 3 identifies, refines,
and expands ICT SCRM-related controls from [NIST SP 800-53 Rev. 4], adds new controls that address
specific ICT SCRM concerns, and offers ICT SCRM-specific supplemental guidance where appropriate.
Figure 1-5 illustrates the process used to create the enhanced overlay. The individual controls and
enhancements from [NIST SP 800-53 Rev. 4] that were relevant to ICT SCRM were extracted. These
controls were analyzed to determine how they apply to ICT SCRM. Additional supplemental guidance
was then developed and included for each control and control enhancement. The resulting set of controls
and enhancements were evaluated to determine whether all ICT SCRM concerns were addressed. A new
control family, Provenance, and some additional controls and control enhancements were created to
address specific remaining ICT SCRM concerns.
Figure 1-5: ICT SCRM Security Controls in NIST SP 800-161, Chapter 3.5
Managing Cost and Resources
Organizations should be aware that implementing these controls will require financial and human
resources. Any requirements that result from federal agencies implementing these controls may also
require financial and human resources from their system integrators, suppliers, and external service
providers potentially resulting in increased costs to the federal acquirers. The acquirers should be
cognizant of the costs and weigh them against the risks to the organization of not selecting ICT SCRM
controls. When appropriate, allow system integrators, suppliers, and external services providers the
opportunity to reuse any existing data and documentation that may provide evidence to support ICT
SCRM. The challenge of balancing ICT supply chain risks with the costs and benefits of mitigating
controls should be a key component of the acquirer’s overall approach to ICT SCRM.
1.8 ORGANIZATION OF THIS SPECIAL PUBLICATION
This publication is organized as follows:
Chapter 1 provides the purpose, scope, and applicability of the publication and describes
foundational concepts and practices;
CHAPTER 1 PAGE 14