NIST.SP.800-161

Special Publication 800-161
Supply Chain Risk Management Practices for Federal
Information Systems and Organizations
________________________________________________________________________________________________________
Security requirements
An organization ICT SCRM policy is a critical vehicle for guiding ICT SCRM activities. Driven by
applicable laws and regulations, this policy should support applicable organization policies including
acquisition and procurement, information security, quality, and supply chain and logistics. It should
address goals and objectives articulated in the overall agency strategic plan, as well as specific mission
functions and business goals, along with the internal and external customer requirements. It should also
define the integration points for ICT SCRM with the agency’s Risk Management Process and SDLC.
ICT SCRM policy should define ICT SCRM-related roles and responsibilities of the agency ICT SCRM
team, any dependencies among those roles, and the interaction among the roles. ICT SCRM-related roles
will articulate responsibilities for collecting ICT supply chain threat intelligence, conducting risk
assessments, identifying and implementing risk-based mitigations, and performing monitoring functions.
Identifying and validating roles will help to specify the amount of effort that will be required to
implement the ICT SCRM Plan. Examples of ICT SCRM-related roles include:
Risk executive function that provides overarching ICT supply chain risk guidance to engineering
decisions that specify and select ICT products as the system design is finalized;
Procurement officer and maintenance engineering responsible for identifying and replacing the
hardware when defective;
Delivery organization and acceptance engineers who verify that the part is acceptable to receive
into the acquiring organization;
System integrator responsible for system maintenance and upgrades, whose staff resides in the
acquirer facility and uses system integrator development infrastructure and the acquirer
operational infrastructure;
System Security Engineer/Systems Engineer responsible for ensuring that information system
security concerns are properly identified and addressed; and
The end user of ICT systems/components/services.
ICT SCRM requirements should be guided by the ICT SCRM policy, as well as by the mission functions
and their criticality at Tier 2 and by known functional and security requirements at Tier 3.
RISK TOLERANCE
TASK 1-3: Identify the level of risk tolerance for the organization.
Supplemental Guidance:
Risk tolerance is the level of risk that organizations are willing to accept in pursuit of strategic goals and
objectives [NIST SP 800-39]. Organizations should take into account ICT supply chain threats,
vulnerabilities, constraints, and baseline criticality, when identifying the overall level of risk tolerance. 17
17
Federal Departments’ and Agencies’ governance structures vary widely (see [NIST SP 800-100, Section 2.2.2]). Regardless of
the governance structure, individual agency risk decisions should apply to the agency and any subordinate organizations, but not
in the reverse direction.
CHAPTER 2 PAGE 32