NIST.SP.800-161

Special Publication 800-161
Supply Chain Risk Management Practices for Federal
Information Systems and Organizations
________________________________________________________________________________________________________
Figure 2-3: ICT SCRM Risk Management
The steps in the risk management process – Frame, Assess, Respond, and Monitor - are iterative and not
inherently sequential in nature. Different individuals may be required to perform the steps at the same
time depending on a particular need or situation. Organizations have significant flexibility in how the risk
management steps are performed (e.g., sequence, degree of rigor, formality, and thoroughness of
application) and in how the results of each step are captured and shared—both internally and externally.
The outputs from a particular risk management step will directly impact one or more of the other risk
management steps in the risk management process.
Figure 2-4 summarizes ICT SCRM activities throughout the risk management process as they are
performed within the three organizational tiers. The arrows between different steps of the risk
management process depict simultaneous flow of information and guidance among the steps. Together the
arrows indicate that the inputs, activities, and outputs are continuously interacting and influencing one
another. More details are provided in the following subsections.
CHAPTER 2 PAGE 22