SP 800-161 Rev. 1 (Update 1)Final2024

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations

At a glanceNIST's comprehensive guide to managing cybersecurity risk from suppliers and technology products, with strategy, policy, plans, risk assessments, controls and templates. It is long and written for large organizations; districts should start with SP 1305 and SP 1326 and use this for depth.

Reading level: Technical
Length: 325 pages · about 60 min for the key parts
Best for: Technology directors, Business officials
CSF 2.0: Govern, Identify

Read it on NIST DOI 10.6028/NIST.SP.800-161r1-upd1 ↗

Browse the full library. 70 NIST publications summarized for school districts.

Key concepts

The publication ties supply chain risk management into enterprise risk management at every level, describes critical success factors, provides supply chain controls built on SP 800-53, a risk exposure framework and templates. Update 1 (November 2024) refreshed the May 2022 Revision 1, and NIST added a fillable assessment scoping questionnaire in 2025.

How it is organized

Integrating supply chain risk management into enterprise risk management
Critical success factors
Appendix A: supply chain security controls
Appendix C: risk exposure framework
Appendix D: templates (strategy, policy, plan, assessment)

What a school district should take from it

Use the templates as models for a short district vendor risk policy and review procedure.
Concentrate effort on the few vendors that hold the most student data or run the most critical systems.

How to use it in your district

Adapt the policy template into a one-page district vendor risk policy.
Classify vendors by criticality and data sensitivity and review the top tier each year.
Use the assessment questionnaire as a source of questions for critical vendors.

Common misconceptions

Supply chain risk only means hardware tampering.: It includes software, cloud services and the vendors that hold district data.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

GV.SCCybersecurity Supply Chain Risk Management
ID.RARisk Assessment

Tools in the program portal

Vendor RegistryKnow which vendors hold district data
Student data privacy agreementsTrack a signed agreement for every vendor that receives student data
Policy BuilderDraft policy language tied to rubric categories

Related publications

SP 1305Supply chain risk quick-start
SP 1326Vendor due diligence quick-start

Citation and source

SP 800-161 Rev. 1 (Update 1), Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations. National Institute of Standards and Technology. 2024. https://doi.org/10.6028/NIST.SP.800-161r1-upd1.

Replaces: SP 800-161 Rev. 1 (May 2022, withdrawn 2024-11-01).

Topics: Vendors and supply chain, Governance and risk. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.