Key concepts
The guide aligns with SP 800-161 Rev. 1 and focuses on information and communications technology suppliers, giving organizations a structured way to gather and weigh due diligence information.
How it is organized
- Foreign ownership, control or influence
- Provenance
- Resilience
- Foundational cyber practices
- Supply chain tiers
What a school district should take from it
- A few structured questions before purchase prevent most surprises later.
- Ask about a vendor's own suppliers when they host student data.
How to use it in your district
- Turn the five areas into a vendor review checklist for products that hold student or staff data.
- Record the review result and date in the Vendor Registry.
- Repeat the review at renewal for critical vendors.
Common misconceptions
- Due diligence requires a security audit of every vendor.
- Scale the review to the vendor's criticality and the data it holds.
Rubric categories and K12 Cyber Forward tools
Cybersecurity Rubric 2.0 categories
- GV.SCCybersecurity Supply Chain Risk Management
Tools in the program portal
- Vendor RegistryKnow which vendors hold district data
- Student data privacy agreementsTrack a signed agreement for every vendor that receives student data
- Guide: Vendor data privacy agreementsPublic guide
Related publications
- SP 1305Supply chain risk quick-start
- SP 800-161 Rev. 1 (Update 1)Supply chain risk management practices
Citation and source
SP 1326, NIST Cybersecurity Supply Chain Risk Management: Due Diligence Assessment Quick-Start Guide. National Institute of Standards and Technology. 2026. https://doi.org/10.6028/NIST.SP.1326.
Topics: Vendors and supply chain. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.