NIST SP 800-161

Supply Chain Risk Management: C-SCRM practices for ICT supply chain risks.


Short name	SP 800-161
Region	Americas
Country or scope	United States
Sector	Government
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers SP 800-161

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 12 controls from Safeguard's control catalog for SP 800-161.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for SP 800-161 and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`SP800161-CM-8` System Component Inventory	An accurate, current inventory of system components must be developed and maintained (NIST SP 800-161 Rev. 1, control CM-8)	Scan
`SP800161-SR-4` Provenance	Provenance of systems and components must be documented, monitored and maintained, including who produced the composition record (NIST SP 800-161 Rev. 1, control SR-4)	Scan
`SP800161-SR-4-TRACE` Supply Chain Traceability	Provenance includes traceability of components through the supply chain, mapping to documented dependency relationships (NIST SP 800-161 Rev. 1, SR-4 traceability, incl. SBOM enhancement)	Scan
`SP800161-SR-11` Component Authenticity	Anti-counterfeit and authenticity controls require the ability to verify component integrity via cryptographic hashes (NIST SP 800-161 Rev. 1, control SR-11)	Scan
`SP800161-SR-3` Supply Chain Controls and Processes	Supply chain risk controls must be applied to suppliers of components, presupposing a named supplier for each component (NIST SP 800-161 Rev. 1, control SR-3)	Scan
`SP800161-RA-5` Vulnerability Monitoring	Components must be monitored and scanned for vulnerabilities, which requires identifiability against vulnerability databases via PURL or CPE (NIST SP 800-161 Rev. 1, control RA-5)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`SR-1`	Supply Chain Risk Management Policy and Procedures
`SR-2`	Supply Chain Risk Management Plan
`SR-4`	Provenance of Components and Software
`SR-5`	Acquisition Strategies and Supply Chain Controls
`SR-6`	Supplier Assessments and Reviews
`SR-8`	Notification Agreements with Suppliers
`SR-9`	Tamper Resistance and Detection
`SR-10`	Inspection of Systems and Components
`SR-11`	Component Authenticity
`SR-12`	Component Disposal
`SA-12`	Supply Chain Protection
`SA-15`	Development Process, Standards, and Tools

Policy templates

Written for SP 800-161:

Supply Chain Risk Management Program Policy
ICT Supplier Security Controls Policy
ICT Component Authenticity and Tamper Resistance Policy

And 22 from the standard set, adapted to SP 800-161.