NIST.SP.800-161

Special Publication 800-161
Supply Chain Risk Management Practices for Federal
Information Systems and Organizations
________________________________________________________________________________________________________
List of Figures and Tables
FIGURE 1-1: FOUR PILLARS OF ICT SCRM ....................................................................................................................... 4
FIGURE 1-2: FEDERAL AGENCY RELATIONSHIPS WITH SYSTEM INTEGRATORS, SUPPLIERS, AND EXTERNAL SERVICE PROVIDERS WITH
RESPECT TO THE SCOPE OF NIST SP 800-161. ........................................................................................................ 5
FIGURE 1-3: ICT SUPPLY CHAIN RISK .............................................................................................................................. 7
FIGURE 1-4: AN ORGANIZATION’S VISIBILITY, UNDERSTANDING, AND CONTROL OF ITS ICT SUPPLY CHAINS ................................. 8
FIGURE 1-5: ICT SCRM SECURITY CONTROLS IN NIST SP 800-161, CHAPTER 3.5 .............................................................. 14
FIGURE 2-1: RISK MANAGEMENT PROCESS .................................................................................................................... 16
FIGURE 2-2: MULTITIERED ORGANIZATION-WIDE RISK MANAGEMENT ................................................................................ 18
FIGURE 2-3: ICT SCRM RISK MANAGEMENT ................................................................................................................. 22
FIGURE 2-4: ICT SCRM ACTIVITIES IN RISK MANAGEMENT PROCESS.................................................................................. 23
FIGURE 2-5: ICT SCRM IN THE FRAME STEP .................................................................................................................. 25
FIGURE 2-6: ICT SCRM IN THE ASSESS STEP .................................................................................................................. 34
FIGURE 2-7: ICT SCRM IN THE RESPOND STEP ............................................................................................................... 41
FIGURE 2-8: ICT SCRM IN THE MONITOR STEP .............................................................................................................. 46
FIGURE 3-1: ICT SCRM SECURITY CONTROLS IN NIST SP 800-161, CHAPTER 3.5 .............................................................. 50
FIGURE D-1: SAMPLE THREAT SCENARIO ANALYSIS FRAMEWORK ..................................................................................... D-4
FIGURE E-1: ISO/IEC 15288 LIFE CYCLE PROCESSES ..................................................................................................... E-1
FIGURE E-2: ICT SCRM PLAN AND LIFE CYCLES ............................................................................................................. E-2
FIGURE E-3: AGENCY IMPLEMENTATION OF ICT SCRM PLAN ........................................................................................... E-7
TABLE 2-1: SUPPLY CHAIN RISK MANAGEMENT STAKEHOLDERS ......................................................................................... 19
TABLE 2-2: EXAMPLES OF ICT SUPPLY CHAIN THREAT AGENTS .......................................................................................... 27
TABLE 2-3: SUPPLY CHAIN THREAT CONSIDERATIONS ....................................................................................................... 28
TABLE 2-4: SUPPLY CHAIN VULNERABILITY CONSIDERATIONS ............................................................................................. 29
TABLE 2-5: SUPPLY CHAIN CONSTRAINTS ....................................................................................................................... 31
TABLE 2-6: EXAMPLES OF ICT SUPPLY CHAIN VULNERABILITIES MAPPED TO THE ORGANIZATIONAL TIERS .................................. 38
TABLE 2-7: ICT SCRM PLAN CONTROLS AT TIERS 1, 2, AND 3 .......................................................................................... 45
TABLE 3-2: ICT SCRM CONTROL FORMAT .................................................................................................................... 53
TABLE A-1: ICT SCRM CONTROL SUMMARY ............................................................................................................... A-1
TABLE C-1: ADVERSARIAL ICT SUPPLY CHAIN THREAT EVENTS ......................................................................................... C-1
TABLE C-2: NON-ADVERSARIAL ICT SUPPLY CHAIN THREAT EVENTS ................................................................................. C-6
Page vii