NIST.SP.800-161

Special Publication 800-161
Supply Chain Risk Management Practices for Federal
Information Systems and Organizations
________________________________________________________________________________________________________
program/project or individual information system needs, are defined in this step. The data and information
collected during Frame provides inputs for scoping and fine-tuning ICT SCRM activities in other risk
management process steps throughout the three tiers.
[NIST SP 800-39] defines risk framing as “the set of assumptions, constraints, risk tolerances, and
priorities/trade-offs that shape an organization’s approach for managing risk.” ICT SCRM risk framing
should be integrated into the overall organization risk framing process. Outputs of the organization’s risk
framing and the overall risk management process should serve as inputs into the ICT SCRM risk framing,
including but not limited to:
Organization policies, strategies, and governance;
Applicable laws and regulations;
Mission functions and business goals;
Organization processes (security, quality, etc.);
Organization threats, vulnerabilities, risks, and risk tolerance;
Criticality of mission functions;
Enterprise architecture;
Mission-level security policies;
Functional requirements; and
Security requirements.
ICT SCRM risk framing is an iterative process that also uses inputs from the other steps of the risk
management process (Assess, Respond, and Monitor) as inputs. Figure 2-5 depicts the Frame Step with
its inputs and outputs along the three organizational tiers.
CHAPTER 2 PAGE 24