NIST.SP.800-161

Special Publication 800-161
Supply Chain Risk Management Practices for Federal
Information Systems and Organizations
________________________________________________________________________________________________________
3.3.2 Suppliers .......................................................................................................................................... 51
3.3.3 External Providers of Information System Services ......................................................................... 52
3.4 SELECTING AND TAILORING IMPLEMENTING ICT SCRM SECURITY CONTROLS ............................................ 52
3.4.1 ICT SCRM Control Format ................................................................................................................ 52
3.4.2 Using ICT SCRM Controls in This Publication ................................................................................... 53
3.5 ICT SCRM SECURITY CONTROLS ................................................................................................................... 55
FAMILY: ACCESS CONTROL .......................................................................................................................... 55
FAMILY: AWARENESS AND TRAINING ......................................................................................................... 60
FAMILY: AUDIT AND ACCOUNTABILITY ....................................................................................................... 62
FAMILY: SECURITY ASSESSMENT AND AUTHORIZATION ............................................................................. 65
FAMILY: CONFIGURATION MANAGEMENT ................................................................................................. 68
FAMILY: CONTINGENCY PLANNING ............................................................................................................. 74
FAMILY: IDENTIFICATION AND AUTHENTICATION ...................................................................................... 77
FAMILY: INCIDENT RESPONSE ...................................................................................................................... 79
FAMILY: MAINTENANCE .............................................................................................................................. 81
FAMILY: MEDIA PROTECTION ...................................................................................................................... 85
FAMILY: PHYSICAL AND ENVIRONMENTAL PROTECTION ............................................................................ 86
FAMILY: PLANNING ...................................................................................................................................... 88
FAMILY: PROGRAM MANAGEMENT ............................................................................................................ 90
FAMILY: PERSONNEL SECURITY ................................................................................................................... 92
FAMILY: PROVENANCE ................................................................................................................................ 94
FAMILY: RISK ASSESSMENT .......................................................................................................................... 97
FAMILY: SYSTEM AND SERVICES ACQUISITION ............................................................................................ 98
FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION ......................................................................... 110
FAMILY: SYSTEM AND INFORMATION INTEGRITY ..................................................................................... 115
ICT SCRM CONTROL SUMMARY ............................................................................................................................. 1
NIST SP 800-53 ICT SCRM-RELEVANT CONTROLS .................................................................................................... 1
FAMILY: ACCESS CONTROL ............................................................................................................................ 1
FAMILY: AWARENESS AND TRAINING ......................................................................................................... 12
FAMILY: AUDIT AND ACCOUNTABILITY ....................................................................................................... 14
FAMILY: SECURITY ASSESSMENT AND AUTHORIZATION ............................................................................. 19
FAMILY: CONFIGURATION MANAGEMENT ................................................................................................. 25
FAMILY: CONTINGENCY PLANNING ............................................................................................................. 35
FAMILY: IDENTIFICATION AND AUTHENTICATION ...................................................................................... 40
FAMILY: INCIDENT RESPONSE ...................................................................................................................... 44
FAMILY: MAINTENANCE .............................................................................................................................. 47
FAMILY: MEDIA PROTECTION ...................................................................................................................... 52
FAMILY: PHYSICAL AND ENVIRONMENTAL PROTECTION ............................................................................ 54
FAMILY: PLANNING ...................................................................................................................................... 58
FAMILY: PROGRAM MANAGEMENT ............................................................................................................ 61
FAMILY: PERSONNEL SECURITY ................................................................................................................... 64
FAMILY: RISK ASSESSMENT .......................................................................................................................... 66
FAMILY: SYSTEM AND SERVICES ACQUISITION ............................................................................................ 69
FAMILY: SYSTEM AND COMMUNICATIONS PROTECTION ........................................................................... 88
FAMILY: SYSTEM AND INFORMATION INTEGRITY ....................................................................................... 96
ICT SUPPLY CHAIN THREAT EVENTS ....................................................................................................................... 1
SUPPLY CHAIN THREAT SCENARIOS AND ANALYSIS FRAMEWORK ......................................................................... 1
Page v