NIST.SP.800-161

Special Publication 800-161
Supply Chain Risk Management Practices for Federal
Information Systems and Organizations
________________________________________________________________________________________________________
Figure 2-2: Multitiered Organization-wide Risk Management 11
In general, Tier 1 is engaged in the development of the overall ICT SCRM strategy, determination of
organization-level ICT SCRM risks, and setting of the organization-wide ICT SCRM policies to guide the
organization’s activities in establishing and maintaining organization-wide ICT SCRM capability. Tier 2
is engaged in prioritizing the organization’s mission and business functions, conducting mission/businesslevel
risk assessment, implementing Tier 1 strategy and guidance to establish an overarching
organizational capability to manage ICT supply chain risks, and guiding organization-wide ICT
acquisitions and their corresponding SDLCs. Tier 3 is involved in specific ICT SCRM activities to be
applied to individual information systems and information technology acquisitions, including integration
of ICT SCRM into these systems’ SDLCs.
The ICT SCRM activities can be performed by a variety of individuals or groups within an organization
ranging from a single individual to committees, divisions, programs, or any other organizational
structures. ICT SCRM activities will be distinct for different organizations depending on their
organization’s structure, culture, mission, and many other factors. It should be noted that this publication
gives organizations the flexibility to either develop stand-alone documentation (e.g., policies, assessment
and authorization [A&A] plan and ICT SCRM Plan) for ICT SCRM, or to integrate it into existing
agency documentation.
11
Further information about the concepts depicted in Figure 2-2 can be found in [NIST SP 800-39].
CHAPTER 2 PAGE 18