NIST SP 800-161

No changes recorded yet — we are watching, and nothing has been published.

1. 2026-07-08 NIST SP 1326, a quick-start guide on due diligence assessment of suppliers based on SP 800-161 Rev. 1, published
2. 2026-06-30 SP 800-18 Rev. 2 published, covering security, privacy and cybersecurity supply chain risk management plans for systems
3. 2025-12-02 Fillable version of the SCRM Assessment Scoping Questionnaire (Table 26) released
4. 2024-11-01 SP 800-161 Rev. 1 errata update published

1. 2024-11-01
   SP 800-161 Rev. 1 (update 1) ErrataCurrent text

   Errata update: deleted the confusing Table 3-1 on C-SCRM in the procurement process, added a semiconductor supply chain risk example, updated references to CSF 2.0 and the revised SP 800-160 volumes, added references such as IEC 62443-4-1 and ISO/IEC 29147, and corrected control wording. source

2. 2022-05-05
   SP 800-161 Rev. 1 Major version

   Retitled "Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations" (the original covered federal systems only). source

   More

   • It integrates cybersecurity supply chain risk management (C-SCRM) into risk management at every organizational level.
   • It guides C-SCRM strategy, policies, plans and risk assessments, and responds to Executive Order 14028 and FASCSA in dedicated appendices.
3. 2021-10-28
   SP 800-161 Rev. 1 (final draft) Draft

   Last of three public drafts of Rev. 1 (February 2020, April 2021, October 2021). source

4. 2015-04-08
   SP 800-161 Major version

   First edition, "Supply Chain Risk Management Practices for Federal Information Systems and Organizations". source

SP 800-161 is guidance meant to be tailored to an organization's size, resources and risks.

Tailored guidance

SP 800-161 is guidance meant to be tailored to an organization's size, resources and risks; it offers no single roadmap. source

Executive Order 14028

Federal departments and agencies are pointed to its Appendix F to implement Executive Order 14028. source

Cloud services

For cloud services, agencies use FedRAMP first and apply SP 800-161 to what FedRAMP does not cover. source

Other organizations

Nongovernmental organizations may use it voluntarily. source

Organizations assess suppliers and products with the publication's risk assessment guidance.

Assessing suppliers

Organizations assess suppliers and products with the publication's risk assessment guidance and its SCRM Assessment Scoping Questionnaire. source source

Practices

It prioritises practices as foundational, sustaining and enabling but sets no maturity path. source

NIST is not a regulatory agency; federal agencies report on supply chain risk management through FISMA.

Not a regulator

NIST is not a regulatory agency. source

Federal agencies

Federal agencies report on supply chain risk management through FISMA, as required since FASCSA. source

1. Standard NIST SP 800-161 Rev. 1, update 1 – Cybersecurity Supply Chain Risk Management Practices (PDF)
2. Template SP 800-161 Rev. 1 publication page (fillable SCRM Assessment Scoping Questionnaire)
3. Guidance NIST SP 1326 – C-SCRM Due Diligence Assessment Quick-Start Guide (July 2026)

1. NIST SSDF

   The SSDF covers how a producer builds software securely; SP 800-161 covers how the buyer manages supply chain risk across all acquired products and services.

2. NIST SP 800-53

   SP 800-53 Rev. 5 contains the Supply Chain Risk Management (SR) control family; SP 800-161 explains how to apply C-SCRM controls across an enterprise.

3. FAR 52.204-25

   FAR 52.204-25 bans specific covered telecommunications equipment by law; SP 800-161 is risk-based guidance without named prohibitions.

4. EO 14028

   Executive Order 14028 required software supply chain guidance; SP 800-161 Rev. 1 Appendix F is NIST's response for agencies.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 19 September 2026. Subscribe to NIST SP 800-161 (RSS)