NIST SP 800-161 Rev 1

United States

vRevision 1 (May 2022)

20 domains

191 controls

NIST SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations. Appendix A is an enhanced overlay on NIST SP 800-53 Rev. 5: it selects the controls that bear on cybersecurity supply chain risk, organizes them into the 20 SP 800-53 control families, and adds C-SCRM supplemental guidance. Two controls, MA-8 and SR-13, are defined by this publication and do not exist in SP 800-53 Rev. 5.

Verified

NIST SP 800-161 Rev 1 is a compliance framework from United States with 20 domains and 191 controls that map to 37 other frameworks. The largest domains are C-SCRM Family: Program Management (30 controls), C-SCRM Family: System and Services Acquisition (15 controls), C-SCRM Family: Access Control (14 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (20)

C-SCRM Family: Access Control

14 controls

Controls in the C-SCRM Family: Access Control domain of NIST SP 800-161 Rev 1 — 14 controls
Code	Title	Description
161R1-AC-1	Policy and Procedures	Extends access control policy and procedure to cover suppliers, developers, integrators and service providers, and to be...
161R1-AC-17	Remote Access	Governs remote access used by suppliers and service providers, which is the ordinary way supply chain access actually ha...
161R1-AC-18	Wireless Access	Addresses wireless access introduced or used by suppliers, integrators and delivered equipment.
161R1-AC-19	Access Control for Mobile Devices	Controls supplier and integrator mobile devices that connect to the environment or carry organizational information.
161R1-AC-2	Account Management	Brings supplier, developer and service provider accounts inside the account lifecycle, including accounts created for ma...
161R1-AC-20	Use of External Systems	Sets the terms under which organizational information may be processed on supplier and provider systems, and verifies th...
161R1-AC-21	Information Sharing	Governs what supply chain information is shared, with whom, and under what handling conditions.
161R1-AC-22	Publicly Accessible Content	Prevents supply chain detail that would help an adversary target suppliers or components from reaching public channels.
161R1-AC-23	Data Mining Protection	Protects supply chain data holdings from mining that would reveal dependencies, volumes or criticality.
161R1-AC-24	Access Control Decisions	Ensures decisions to grant supply chain access are made on defined attributes rather than on the strength of a commercia...
161R1-AC-3	Access Enforcement	Enforces the boundary between what a supplier or integrator is authorized to reach and the rest of the environment, rath...
161R1-AC-4	Information Flow Enforcement	Controls where supply chain information moves, including data shared with and received from suppliers and integrators.
161R1-AC-5	Separation of Duties	Separates the duties that would let one party both select or supply a component and approve its acceptance.
161R1-AC-6	Least Privilege	Holds supplier, developer and integrator privilege to the minimum the engagement needs, for the time it needs it.

C-SCRM Family: Assessment, Authorization, and Monitoring

6 controls

Controls in the C-SCRM Family: Assessment, Authorization, and Monitoring domain of NIST SP 800-161 Rev 1 — 6 controls
Code	Title	Description
161R1-CA-1	Policy and Procedures	Establishes assessment and authorization policy that covers suppliers, delivered components and external service provide...
161R1-CA-2	Control Assessments	Assesses the controls that suppliers and providers operate, rather than accepting a claim that they exist.
161R1-CA-3	Information Exchange	Governs the connections and exchanges between the organization and its suppliers, integrators and providers.
161R1-CA-5	Plan of Action and Milestones	Tracks supply chain weaknesses to closure with named owners and dates, including weaknesses residing with a supplier.
161R1-CA-6	Authorization	Makes supply chain risk an explicit input to the decision to authorize a system to operate.
161R1-CA-7	Continuous Monitoring	Monitors supplier and component risk continuously rather than at the point of purchase or renewal.

C-SCRM Family: Audit and Accountability

9 controls

Controls in the C-SCRM Family: Audit and Accountability domain of NIST SP 800-161 Rev 1 — 9 controls
Code	Title	Description
161R1-AU-1	Policy and Procedures	Extends audit and accountability policy to cover supply chain events and the logging obligations placed on suppliers.
161R1-AU-10	Non-repudiation	Establishes that actions taken by suppliers and integrators, and the provenance claims they make, cannot later be repudi...
161R1-AU-12	Audit Record Generation	Ensures delivered and supplier-operated components actually generate the audit records the organization needs.
161R1-AU-13	Monitoring for Information Disclosure	Watches external channels for disclosure of organizational or supply chain information, including by suppliers.
161R1-AU-14	Session Audit	Captures supplier and integrator sessions where the risk warrants observing what was actually done.
161R1-AU-16	Cross-Organizational Audit Logging	Coordinates logging across organizational boundaries so that activity spanning the organization and its suppliers can be...
161R1-AU-2	Event Logging	Defines the supply chain events worth logging, such as component receipt, supplier access, and changes made by integrato...
161R1-AU-3	Content of Audit Records	Requires audit records to identify which supplier, integrator or provider performed an action, not just which account.
161R1-AU-6	Audit Review, Analysis, and Reporting	Reviews supply chain activity in the logs for signs of misuse of supplier access or unexpected change by integrators.

C-SCRM Family: Awareness and Training

4 controls

Controls in the C-SCRM Family: Awareness and Training domain of NIST SP 800-161 Rev 1 — 4 controls
Code	Title	Description
161R1-AT-1	Policy and Procedures	Establishes awareness and training policy that explicitly covers cybersecurity supply chain risk and the people who make...
161R1-AT-2	Literacy Training and Awareness	Builds general awareness of supply chain threat, including counterfeit components, tampering and supplier compromise.
161R1-AT-3	Role-Based Training	Trains the roles that carry C-SCRM duties, including procurement, receiving, engineering and supplier management.
161R1-AT-4	Training Records	Keeps the training record that shows who is competent to carry a C-SCRM duty, including supplier personnel where require...

C-SCRM Family: Configuration Management

14 controls

Controls in the C-SCRM Family: Configuration Management domain of NIST SP 800-161 Rev 1 — 14 controls
Code	Title	Description
161R1-CM-1	Policy and Procedures	Extends configuration management policy to cover components sourced externally and changes made by suppliers and integra...
161R1-CM-10	Software Usage Restrictions	Controls the terms and provenance under which software, including open source, may be used.
161R1-CM-11	User-Installed Software	Prevents users and integrators from installing software of unverified origin onto organizational systems.
161R1-CM-12	Information Location	Identifies where organizational information sits across the supply chain, including on supplier and provider systems.
161R1-CM-13	Data Action Mapping	Maps the actions taken on organizational data, including by suppliers and processors, so exposure is visible.
161R1-CM-14	Signed Components	Requires and verifies cryptographic signatures on delivered software, firmware and updates before installation.
161R1-CM-2	Baseline Configuration	Establishes the baseline for delivered components so that later supplier changes can be detected against a known startin...
161R1-CM-3	Configuration Change Control	Brings supplier-initiated and vendor-pushed changes inside change control rather than letting them arrive unannounced.
161R1-CM-4	Impact Analysis	Analyses the effect of supplier and component changes before they are accepted, including effects on other dependencies.
161R1-CM-5	Access Restrictions for Change	Restricts who, including which supplier personnel, may change components, and records when that right is exercised.
161R1-CM-6	Configuration Settings	Sets and verifies secure settings on delivered components rather than accepting the supplier default.
161R1-CM-7	Least Functionality	Removes supplier-included functionality that the organization does not need and that widens the attack surface.
161R1-CM-8	System Component Inventory	Maintains the component inventory to the depth needed for supply chain purposes, including supplier, origin and support...
161R1-CM-9	Configuration Management Plan	Sets out how configuration will be managed across the organization and its suppliers for the life of the system.

C-SCRM Family: Contingency Planning

8 controls

Controls in the C-SCRM Family: Contingency Planning domain of NIST SP 800-161 Rev 1 — 8 controls
Code	Title	Description
161R1-CP-1	Policy and Procedures	Extends contingency policy to cover the loss of a supplier, provider or component source, not only the loss of a facilit...
161R1-CP-11	Alternative Communications Protocols	Provides alternate communications capability where the primary protocol or its supplier becomes unavailable.
161R1-CP-2	Contingency Plan	Plans for continued operation when a critical supplier, integrator or component source becomes unavailable.
161R1-CP-3	Contingency Training	Trains the people who would have to act if a supplier or component source failed.
161R1-CP-4	Contingency Plan Testing	Tests the supply chain elements of the contingency plan, including whether alternate sources can actually deliver.
161R1-CP-6	Alternative Storage Site	Applies supply chain scrutiny to the alternate storage site and the providers that operate it.
161R1-CP-7	Alternative Processing Site	Applies the same supply chain scrutiny to alternate processing capability and its provider.
161R1-CP-8	Telecommunications Services	Addresses dependence on telecommunications suppliers, including shared upstream carriers behind nominally separate servi...

C-SCRM Family: Identification and Authentication

7 controls

Controls in the C-SCRM Family: Identification and Authentication domain of NIST SP 800-161 Rev 1 — 7 controls
Code	Title	Description
161R1-IA-1	Policy and Procedures	Extends identification and authentication policy to suppliers, integrators, provider staff and non-organizational users.
161R1-IA-2	Identification and Authentication (Organizational Users)	Ensures supplier and integrator personnel working as organizational users are individually identified and strongly authe...
161R1-IA-3	Device Identification and Authentication	Authenticates devices introduced by suppliers or delivered as part of a component before they are trusted on the network...
161R1-IA-4	Identifier Management	Manages identifiers issued to external parties so they are unique, attributable and retired at engagement end.
161R1-IA-5	Authenticator Management	Manages authenticators issued to or by suppliers, including default credentials shipped with delivered components.
161R1-IA-8	Identification and Authentication (Non-Organizational Users)	Handles authentication of supplier and partner users who are not organizational users but still reach organizational sys...
161R1-IA-9	Service Identification and Authentication	Authenticates the services and interfaces that supply chain parties expose or consume, not only the people.

C-SCRM Family: Incident Response

9 controls

Controls in the C-SCRM Family: Incident Response domain of NIST SP 800-161 Rev 1 — 9 controls
Code	Title	Description
161R1-IR-1	Policy and Procedures	Extends incident response policy to cover incidents originating in or affecting the supply chain, and supplier reporting...
161R1-IR-2	Incident Response Training	Trains responders on supply chain incident scenarios such as compromised updates and supplier breach.
161R1-IR-3	Incident Response Testing	Exercises supply chain incident scenarios, including the parts that depend on a supplier responding.
161R1-IR-4	Incident Handling	Handles incidents that cross the supply chain boundary, where containment depends on a party the organization does not c...
161R1-IR-5	Incident Monitoring	Tracks supply chain incidents and their status across the organizational boundary.
161R1-IR-6	Incident Reporting	Reports supply chain incidents to the parties who need to know, including other users of the same supplier or component.
161R1-IR-7	Incident Response Assistance	Secures the response assistance the organization can call on, including from suppliers and providers, before it is neede...
161R1-IR-8	Incident Response Plan	Includes supply chain scenarios, supplier roles and notification paths in the incident response plan.
161R1-IR-9	Information Spillage Response	Handles spillage of organizational information into supplier environments, and of supplier information into the organiza...

C-SCRM Family: Maintenance

8 controls

Controls in the C-SCRM Family: Maintenance domain of NIST SP 800-161 Rev 1 — 8 controls
Code	Title	Description
161R1-MA-1	Policy and Procedures	Extends maintenance policy to cover maintenance performed by suppliers and original equipment manufacturers, on site and...
161R1-MA-2	Controlled Maintenance	Controls and records maintenance performed by suppliers, including what was replaced and where the removed part went.
161R1-MA-3	Maintenance Tools	Controls the tools and diagnostic media that supplier engineers bring into the environment.
161R1-MA-4	Nonlocal Maintenance	Governs remote maintenance performed by suppliers, which is where most supplier technical access actually occurs.
161R1-MA-5	Maintenance Personnel	Authorizes named supplier personnel rather than supplier organizations, and supervises those who are not authorized.
161R1-MA-6	Timely Maintenance	Secures the spares and supplier support needed to restore critical components within the time the organization can toler...
161R1-MA-7	Field Maintenance	Controls maintenance performed away from the organization's facilities, where custody of the component passes to others.
161R1-MA-8	Maintenance Monitoring and Information Sharing	A control new in this publication: monitors maintenance activity for supply chain risk and shares what is learned with t...

C-SCRM Family: Media Protection

4 controls

Controls in the C-SCRM Family: Media Protection domain of NIST SP 800-161 Rev 1 — 4 controls
Code	Title	Description
161R1-MP-1	Policy and Procedures	Extends media protection policy to media moving to and from suppliers and integrators.
161R1-MP-4	Media Storage	Controls media held on behalf of or received from suppliers until it is sanitized or destroyed.
161R1-MP-5	Media Transport	Protects media in transit between the organization and its suppliers and maintains accountability across the handover.
161R1-MP-6	Media Sanitization	Sanitizes media before it leaves organizational control, including media returned to suppliers under warranty or lease.

C-SCRM Family: Personally Identifiable Information Processing and Transparency

1 controls

Controls in the C-SCRM Family: Personally Identifiable Information Processing and Transparency domain of NIST SP 800-161 Rev 1 — 1 controls
Code	Title	Description
161R1-PT-1	Policy and Procedures	Extends personally identifiable information processing and transparency policy to processing performed across the supply...

C-SCRM Family: Personnel Security

4 controls

Controls in the C-SCRM Family: Personnel Security domain of NIST SP 800-161 Rev 1 — 4 controls
Code	Title	Description
161R1-PS-1	Policy and Procedures	Extends personnel security policy to the supplier, integrator and provider personnel who work on organizational systems.
161R1-PS-3	Personnel Screening	Requires and verifies screening of supplier personnel commensurate with the access they will hold.
161R1-PS-6	Access Agreements	Puts access agreements in place with the individuals from supplier organizations who hold access, not only with their em...
161R1-PS-7	External Personnel Security	Sets and enforces the personnel security requirements applying to external providers, including notification when their...

C-SCRM Family: Physical and Environmental Protection

9 controls

Controls in the C-SCRM Family: Physical and Environmental Protection domain of NIST SP 800-161 Rev 1 — 9 controls
Code	Title	Description
161R1-PE-1	Policy and Procedures	Extends physical protection policy to supplier access, deliveries and the physical points where the supply chain meets t...
161R1-PE-16	Delivery and Removal	Controls what components enter and leave the facility and records their movement, which is the physical control point fo...
161R1-PE-17	Alternative Work Site	Applies supply chain and physical protection expectations to alternate work sites used by contractors and supplier staff...
161R1-PE-18	Location of System Components	Considers where components are physically placed, including whether supplier-managed equipment sits where it can be reac...
161R1-PE-2	Physical Access Authorizations	Authorizes supplier and delivery personnel individually and keeps that authorization current.
161R1-PE-20	Asset Monitoring and Tracking	Tracks components physically through receipt, deployment and disposal so that substitution or diversion is detectable.
161R1-PE-23	Facility Location	Considers supply chain and threat factors in the choice of facility location, including dependence on local infrastructu...
161R1-PE-3	Physical Access Control	Controls physical access at the points where components and suppliers enter, including loading docks and receiving areas...
161R1-PE-6	Monitoring Physical Access	Monitors physical access at supply chain touch points and reviews what the monitoring shows.

C-SCRM Family: Planning

7 controls

Controls in the C-SCRM Family: Planning domain of NIST SP 800-161 Rev 1 — 7 controls
Code	Title	Description
161R1-PL-1	Policy and Procedures	Extends planning policy so that supply chain considerations enter system planning rather than arriving at procurement.
161R1-PL-10	Baseline Selection	Selects the control baseline with supply chain risk taken into account, so C-SCRM controls are chosen rather than assume...
161R1-PL-2	System Security and Privacy Plans	Records the supply chain dependencies, suppliers and C-SCRM controls of a system in its security plan.
161R1-PL-4	Rules of Behavior	Sets the behavioural expectations that apply to supplier, integrator and provider personnel using organizational systems...
161R1-PL-7	Concept of Operations	Describes how the system will actually be operated, including which parts suppliers and providers operate and the bounda...
161R1-PL-8	Security and Privacy Architectures	Builds supply chain considerations into architecture, including diversity, provenance and the ability to replace a suppl...
161R1-PL-9	Central Management	Centrally manages the C-SCRM controls that should be consistent across the organization rather than reinvented per proje...

C-SCRM Family: Program Management

30 controls

Controls in the C-SCRM Family: Program Management domain of NIST SP 800-161 Rev 1 — 30 controls
Code	Title	Description
161R1-PM-10	Authorization Process	Ensures the authorization process carries supply chain risk information to the person making the decision.
161R1-PM-11	Mission and Business Process Definition	Defines mission and business processes in a way that exposes which supply chain elements they actually depend on.
161R1-PM-12	Insider Threat Program	Extends the insider threat programme to insiders introduced through the supply chain, including contractor and integrato...
161R1-PM-13	Security and Privacy Workforce	Builds the workforce capability needed to do C-SCRM work, including acquisition and supplier management skills.
161R1-PM-14	Testing, Training, and Monitoring	Plans and coordinates testing, training and monitoring so that C-SCRM activities are scheduled rather than incidental.
161R1-PM-15	Security and Privacy Groups and Associations	Maintains contact with external groups that share supply chain threat and vulnerability information.
161R1-PM-16	Threat Awareness Program	Maintains awareness of threat actors targeting the supply chain and feeds that awareness into decisions.
161R1-PM-17	Protecting Controlled Unclassified Information on External Systems	Sets and enforces the terms under which external parties may hold controlled unclassified information.
161R1-PM-18	Privacy Program Plan	Includes supply chain processing in the privacy programme plan, since much personal data is handled by providers.
161R1-PM-19	Privacy Program Leadership Role	Names the leader accountable for privacy including the privacy risk carried by the supply chain.
161R1-PM-2	Information Security Program Leadership Role	Places accountability for the cybersecurity supply chain programme with a named leader who has the authority to act on i...
161R1-PM-20	Dissemination of Privacy Program Information	Makes clear to individuals how their information is handled, including by suppliers and providers acting for the organiz...
161R1-PM-21	Accounting of Disclosures	Accounts for disclosures made to and through supply chain parties.
161R1-PM-22	Personally Identifiable Information Quality Management	Maintains data quality across the supply chain, where data passes through providers who may alter or degrade it.
161R1-PM-23	Data Governance Body	Gives the data governance body oversight of data that moves into and through the supply chain.
161R1-PM-25	Minimization of Personally Identifiable Information Used in Testing, Training, and Research	Prevents real personal data being handed to suppliers and developers for testing, training or research.
161R1-PM-26	Complaint Management	Handles complaints that arise from supply chain handling of information and routes them to the responsible party.
161R1-PM-27	Privacy Reporting	Reports on privacy including the risk and incidents arising from the supply chain.
161R1-PM-28	Risk Framing	Frames supply chain risk explicitly: the assumptions, constraints, tolerances and priorities that govern how it is judge...
161R1-PM-29	Risk Management Program Leadership Roles	Names the leadership roles that own supply chain risk and distinguishes them from those who own the systems.
161R1-PM-3	Information Security and Privacy Resources	Funds C-SCRM as a line of work rather than expecting it from existing capacity.
161R1-PM-30	Supply Chain Risk Management Strategy	Sets the organizational C-SCRM strategy and implementation plan that everything else in the programme derives from.
161R1-PM-31	Continuous Monitoring Strategy	Defines what supply chain risk is monitored continuously, how often, and what triggers action.
161R1-PM-32	Purposing	Ensures systems and components are used only for the purpose they were acquired and assessed for, since repurposing inva...
161R1-PM-4	Plan of Action and Milestones Process	Runs a process that carries supply chain weaknesses through to closure at organizational level, not only per system.
161R1-PM-5	System Inventory	Maintains the organizational system inventory in a form that supports supply chain questions such as which systems depen...
161R1-PM-6	Measures of Performance	Measures whether the C-SCRM programme is actually reducing risk rather than producing activity.
161R1-PM-7	Enterprise Architecture	Reflects supply chain dependency and concentration in the enterprise architecture so that structural risk is visible.
161R1-PM-8	Critical Infrastructure Plan	Addresses supply chain dependency in the critical infrastructure plan, including upstream providers the organization doe...
161R1-PM-9	Risk Management Strategy	Sets how supply chain risk is framed, assessed, responded to and monitored as part of the organizational risk strategy.

C-SCRM Family: Risk Assessment

7 controls

Controls in the C-SCRM Family: Risk Assessment domain of NIST SP 800-161 Rev 1 — 7 controls
Code	Title	Description
161R1-RA-1	Policy and Procedures	Extends risk assessment policy so that supply chain risk is assessed as a class of risk in its own right.
161R1-RA-10	Threat Hunting	Hunts for adversary activity introduced through the supply chain rather than waiting for an alert.
161R1-RA-2	Security Categorization	Categorizes systems in a way that carries through to the criticality of the components and suppliers they depend on.
161R1-RA-3	Risk Assessment	Assesses supply chain risk across the enterprise, mission and system levels, and keeps it current.
161R1-RA-5	Vulnerability Monitoring and Scanning	Monitors vulnerabilities in acquired and third-party components, including dependencies the organization did not choose...
161R1-RA-7	Risk Response	Responds to supply chain risk with decisions that are recorded, owned and revisited, including decisions to accept.
161R1-RA-9	Criticality Analysis	Identifies which components and suppliers actually matter, so that C-SCRM effort concentrates where failure would hurt.

C-SCRM Family: Supply Chain Risk Management

13 controls

Controls in the C-SCRM Family: Supply Chain Risk Management domain of NIST SP 800-161 Rev 1 — 13 controls
Code	Title	Description
161R1-SR-1	Policy and Procedures	Establishes the supply chain risk management policy and procedures that the rest of the SR family operates under.
161R1-SR-10	Inspection of Systems or Components	Inspects systems and components at defined points to detect tampering, substitution or counterfeit.
161R1-SR-11	Component Authenticity	Establishes an anti-counterfeit policy and the means to detect and report counterfeit components.
161R1-SR-12	Component Disposal	Disposes of components so that organizational information and the components themselves cannot re-enter the supply chain...
161R1-SR-13	Supplier Inventory	A control new in this publication: maintains an inventory of suppliers so that exposure to any one of them can actually...
161R1-SR-2	Supply Chain Risk Management Plan	Requires a plan for managing supply chain risk for the system, reviewed and updated and protected from disclosure.
161R1-SR-3	Supply Chain Controls and Processes	Establishes the processes that identify and address supply chain risk for the system, in coordination with its suppliers...
161R1-SR-4	Provenance	Establishes and maintains provenance for systems, components and associated data so origin and change history are known.
161R1-SR-5	Acquisition Strategies, Tools, and Methods	Uses acquisition strategy, contract tools and purchasing methods to reduce supply chain risk before it enters the organi...
161R1-SR-6	Supplier Assessments and Reviews	Assesses and reviews suppliers, at a depth matched to what they supply and the access they hold.
161R1-SR-7	Supply Chain Operations Security	Applies operations security to acquisition so that adversaries cannot learn what is being bought, from whom and when.
161R1-SR-8	Notification Agreements	Establishes agreements requiring suppliers to notify the organization of compromise, vulnerability and relevant change.
161R1-SR-9	Tamper Resistance and Detection	Applies tamper resistance and detection to components across development, transport and operation.

C-SCRM Family: System and Communications Protection

14 controls

Controls in the C-SCRM Family: System and Communications Protection domain of NIST SP 800-161 Rev 1 — 14 controls
Code	Title	Description
161R1-SC-1	Policy and Procedures	Extends system and communications protection policy to the connections and components that the supply chain introduces.
161R1-SC-18	Mobile Code	Controls mobile code that arrives with delivered components or from supplier-hosted content.
161R1-SC-27	Platform-Independent Applications	Favours platform independence so that dependency on a single supplier's platform does not become structural.
161R1-SC-28	Protection of Information at Rest	Protects organizational information at rest wherever it sits, including on supplier and provider systems.
161R1-SC-29	Heterogeneity	Uses diversity of components and suppliers so a single compromised source cannot affect everything at once.
161R1-SC-30	Concealment and Misdirection	Uses concealment and misdirection so that supply chain and system detail useful to an adversary is not freely observable...
161R1-SC-36	Distributed Processing and Storage	Distributes processing and storage so that the failure or compromise of one supplier or site does not take everything wi...
161R1-SC-37	Out-of-Band Channels	Maintains out-of-band channels for the information and credentials that must not travel the same path as the thing they...
161R1-SC-38	Operations Security	Applies operations security so that supply chain activity does not reveal capability, dependency or timing to an adversa...
161R1-SC-4	Information in Shared Resources	Prevents information leaking through resources shared with suppliers, providers or other tenants.
161R1-SC-47	Alternative Communications Paths	Provides alternative communications paths that do not share the same supplier or physical route as the primary.
161R1-SC-5	Denial-of-Service Protection	Addresses denial of service risk that arrives through or depends on supply chain parties.
161R1-SC-7	Boundary Protection	Controls and monitors the boundaries where supplier, integrator and provider connections meet the organization.
161R1-SC-8	Transmission Confidentiality and Integrity	Protects information in transit between the organization and its suppliers, providers and integrators.

C-SCRM Family: System and Information Integrity

8 controls

Controls in the C-SCRM Family: System and Information Integrity domain of NIST SP 800-161 Rev 1 — 8 controls
Code	Title	Description
161R1-SI-1	Policy and Procedures	Extends system and information integrity policy to cover integrity of components and updates arriving from the supply ch...
161R1-SI-12	Information Management and Retention	Manages retention and disposal of information across the supply chain, including information held by providers after the...
161R1-SI-2	Flaw Remediation	Remediates flaws in acquired components, where the fix depends on a supplier the organization does not control.
161R1-SI-20	Tainting	Uses tainting techniques so that unauthorized exfiltration of organizational information through the supply chain can be...
161R1-SI-3	Malicious Code Protection	Protects against malicious code introduced through delivered components, updates and supplier channels.
161R1-SI-4	System Monitoring	Monitors for behaviour indicating compromise arriving through the supply chain, such as unexpected outbound activity fro...
161R1-SI-5	Security Alerts, Advisories, and Directives	Receives and acts on advisories concerning acquired components and the suppliers behind them.
161R1-SI-7	Software, Firmware, and Information Integrity	Verifies the integrity of software and firmware received from suppliers, before and after installation.

C-SCRM Family: System and Services Acquisition

15 controls

Controls in the C-SCRM Family: System and Services Acquisition domain of NIST SP 800-161 Rev 1 — 15 controls
Code	Title	Description
161R1-SA-1	Policy and Procedures	Extends system and services acquisition policy so that security and supply chain requirements enter acquisition from the...
161R1-SA-10	Developer Configuration Management	Requires the developer or supplier to manage configuration of what they deliver, and to prove it.
161R1-SA-11	Developer Testing and Evaluation	Requires developers and suppliers to test what they deliver and to make the results available.
161R1-SA-15	Development Process, Standards, and Tools	Sets expectations on the developer's own process, standards and tooling, since delivered security depends on them.
161R1-SA-16	Developer-Provided Training	Obtains the training needed to operate and secure delivered components correctly.
161R1-SA-17	Developer Security and Privacy Architecture and Design	Requires the developer to produce architecture and design evidence sufficient for the organization to judge the security...
161R1-SA-2	Allocation of Resources	Allocates the resources needed to meet supply chain security requirements as part of the acquisition, not as an aftertho...
161R1-SA-20	Customized Development of Critical Components	Considers building or customizing critical components where the market cannot supply them at the assurance level require...
161R1-SA-21	Developer Screening	Requires screening of the developer personnel who will have access to what matters, and verifies it.
161R1-SA-22	Unsupported System Components	Manages components the supplier no longer supports, which is where supply chain risk quietly accumulates.
161R1-SA-3	System Development Life Cycle	Runs C-SCRM activities at defined points across the development life cycle, including for acquired components.
161R1-SA-4	Acquisition Process	Puts security and supply chain requirements into the contract, including the evidence the supplier must provide.
161R1-SA-5	System Documentation	Obtains and retains the documentation needed to operate, secure and assess acquired components over their life.
161R1-SA-8	Security and Privacy Engineering Principles	Applies engineering principles to acquired and integrated components, not only to what is built in house.
161R1-SA-9	External System Services	Governs external service providers across their life cycle, including the security roles each party holds.

Your Compliance Coverage

If you comply with NIST SP 800-161 Rev 1, you already cover:

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1

100%

191 controls mapped

Compare →

NIST SP 800-53 Rev 5

99%

190 controls mapped

Compare →

C5 (Germany)

85%

163 controls mapped

Compare →

+ 34 more: FedRAMP Moderate (72%), FedRAMP High (72%)

See all 37 mapped frameworks ↓

Maps to 37 other frameworks

191 total controls

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1

191 source controls mapped|150 target controls covered

100%

NIST SP 800-53 Rev 5

190 source controls mapped|191 target controls covered

99%

C5 (Germany)

163 source controls mapped|91 target controls covered

85%

FedRAMP Moderate

138 source controls mapped|147 target controls covered

72%

FedRAMP High

137 source controls mapped|146 target controls covered

72%

NIST SP 800-53 Rev 5 MODERATE

132 source controls mapped|131 target controls covered

69%

NIST SP 800-53 Revision 5.1 HIGH

132 source controls mapped|131 target controls covered

69%

NIST SP 800-171 Rev 3

105 source controls mapped|82 target controls covered

55%

NIST SP 800-53 Rev 5 LOW

101 source controls mapped|97 target controls covered

53%

AWS Well-Architected Security Pillar

98 source controls mapped|60 target controls covered

51%

ISO 27002:2022

96 source controls mapped|77 target controls covered

50%

ISO 27001:2022

96 source controls mapped|77 target controls covered

50%

NIST Cybersecurity Framework 2.0

95 source controls mapped|89 target controls covered

50%

NIST SP 800-172

87 source controls mapped|35 target controls covered

46%

HIPAA Security Rule

86 source controls mapped|59 target controls covered

45%

NIST SP 800-66 Rev 2

81 source controls mapped|51 target controls covered

42%

CIS Controls v8

76 source controls mapped|85 target controls covered

40%

CMMC 2.0

73 source controls mapped|73 target controls covered

38%

ISO 27701:2019

72 source controls mapped|66 target controls covered

38%

Azure Security Benchmark

71 source controls mapped|76 target controls covered

37%

PCI DSS 4.0

70 source controls mapped|82 target controls covered

37%

DORA

58 source controls mapped|18 target controls covered

30%

NIST SP 800-218

58 source controls mapped|42 target controls covered

30%

SOC 2

56 source controls mapped|42 target controls covered

29%

CFTC System Safeguards (17 CFR 37, 38, 39, 49)

55 source controls mapped|38 target controls covered

29%

ANSSI Guide d'hygiene informatique (42 mesures, v2.0)

47 source controls mapped|42 target controls covered

25%

Australia Consumer Data Right - Banking (CDR)

42 source controls mapped|17 target controls covered

22%

APRA CPS 234

38 source controls mapped|24 target controls covered

20%

ISO 22301:2019

37 source controls mapped|56 target controls covered

19%

APEC Cross-Border Privacy Rules (CBPR) System

35 source controls mapped|33 target controls covered

18%

APRA CPS 230 Operational Risk Management

32 source controls mapped|34 target controls covered

17%

ASD Strategies to Mitigate Cyber Security Incidents

26 source controls mapped|22 target controls covered

14%

Australia My Health Records Act 2012

25 source controls mapped|10 target controls covered

13%

UK Cyber Essentials

24 source controls mapped|34 target controls covered

13%

APPI

23 source controls mapped|12 target controls covered

12%

ACSC Essential Eight

17 source controls mapped|18 target controls covered

APRA CPS 220 Risk Management

16 source controls mapped|19 target controls covered

Compare NIST SP 800-161 Rev 1 with Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1

What is NIST SP 800-161 Rev 1 and who does it apply to?

NIST SP 800-161 Rev 1 is a compliance framework from United States with 20 domains and 191 controls. NIST SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations. Appendix A is an enhanced overlay on NIST SP 800-53 Rev. 5: it selects the controls that bear on cybersecurity supply chain risk, organizes them into the 20 SP 800-53 control families, and adds C-SCRM supplemental guidance. Two controls, MA-8 and SR-13, are defined by this publication and do not exist in SP 800-53 Rev. 5. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does NIST SP 800-161 Rev 1 actually require?

NIST SP 800-161 Rev 1 has 191 controls organised across 20 domains. The largest domains are C-SCRM Family: Program Management (30 controls), C-SCRM Family: System and Services Acquisition (15 controls), C-SCRM Family: Access Control (14 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of NIST SP 800-161 Rev 1 do I already cover?

NIST SP 800-161 Rev 1 maps to 37 other compliance frameworks. The top mapping partners are Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 (100% coverage), NIST SP 800-53 Rev 5 (99% coverage), C5 (Germany) (85% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement NIST SP 800-161 Rev 1?

Start your NIST SP 800-161 Rev 1 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about NIST SP 800-161 Rev 1 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 191 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.

Get Started Free →

Free forever — no credit card required