NIST.SP.800-161

Special Publication 800-161
Supply Chain Risk Management Practices for Federal
Information Systems and Organizations
________________________________________________________________________________________________________
Reports on Computer Systems Technology
The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology
(NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation’s
measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of
concept implementations, and technical analyses to advance the development and productive use of
information technology. ITL’s responsibilities include the development of management, administrative,
technical, and physical standards and guidelines for the cost-effective security and privacy of other than
national security-related information in federal information systems. The Special Publication 800-series
reports on ITL’s research, guidelines, and outreach efforts in information system security, and its
collaborative activities with industry, government, and academic organizations.
Abstract
Federal agencies are concerned about the risks associated with information and communications
technology (ICT) products and services that may contain potentially malicious functionality, are
counterfeit, or are vulnerable due to poor manufacturing and development practices within the ICT supply
chain. These risks are associated with the federal agencies’ decreased visibility into, understanding of,
and control over how the technology that they acquire is developed, integrated and deployed, as well as
the processes, procedures, and practices used to assure the integrity, security, resilience, and quality of the
products and services.
This publication provides guidance to federal agencies on identifying, assessing, and mitigating ICT
supply chain risks at all levels of their organizations. The publication integrates ICT supply chain risk
management (SCRM) into federal agency risk management activities by applying a multitiered, SCRMspecific
approach, including guidance on assessing supply chain risk and applying mitigation activities.
Keywords
Acquire; Information and Communication Technology Supply Chain Risk Management; ICT SCRM; risk
management; supplier; supply chain; supply chain assurance; supply chain risk; supply chain risk
assessment; supply chain security
Acknowledgements
The authors, Jon Boyens, National Institute of Standards and Technology (NIST), Celia Paulsen (NIST),
Rama Moorthy (Hatha Systems), and Nadya Bartol (Utilities Telecom Council), would like to
acknowledge and thank the ICT SCRM community, which has provided the authors invaluable insight
and diverse perspectives to managing the ICT supply chain. We would especially like to thank Kelly
Dempsey (NIST), Dr. Ron Ross (NIST), and Stephanie Shankles (Booz Allen Hamilton) for their
contribution to the content during the document development and review. We would also like to thank
numerous reviewers within the information technology community who took the time to provide valuable
feedback and comments to the public drafts. Finally, we would like to thank the participants of NIST’s
October 2012 ICT SCRM Workshop for providing the guiding foundation to the approach this
publication has taken.
Page iii