NIST.SP.800-161

Special Publication 800-161
Supply Chain Risk Management Practices for Federal
Information Systems and Organizations
________________________________________________________________________________________________________
CHAPTER TWO
INTEGRATION OF ICT SCRM INTO ORGANIZATION-
WIDE RISK MANAGEMENT
ICT SCRM should be integrated into the organization-wide risk management process described in [NIST
SP 800-39] and depicted in Figure 2-1. This process includes the following continuous and iterative steps:
(i) Frame risk – establish the context for risk-based decisions and the current state of the information
system or ICT supply chain infrastructure;
(ii) Assess risk – review and interpret criticality, threat, vulnerability, likelihood, impact, and related
information;
(iii) Respond to risk once determined – select, tailor, and implement mitigation controls; and
(iv) Monitor risk on an ongoing basis, including changes to an information system or ICT supply
chain infrastructure, using effective organizational communications and a feedback loop for
continuous improvement.
Figure 2-1: Risk Management Process
Managing ICT supply chain risks is a complex, multifaceted undertaking that requires a coordinated
effort across an organization and building trust relationships and communicating with external and
internal partners and stakeholders. This includes: engaging multiple disciplines in identifying priorities
and developing solutions; ensuring that ICT SCRM activities are performed throughout the SDLC; and
incorporating ICT SCRM into overall risk management decisions. ICT SCRM activities should involve
CHAPTER 2 PAGE 16