What it covers. NIST guidance on identifying, assessing and responding to cybersecurity risks that come from suppliers, products and services across the supply chain. It sets out how to embed supply chain risk management at the enterprise, mission and system levels, and provides a tailored set of controls building on SP 800-53.
In practice. Organisations establish a programme with clear ownership, tier suppliers by criticality and apply proportionate assessment before contracting and throughout the relationship. Contracts carry security requirements such as notification duties and the right to request evidence. Useful evidence includes a supplier inventory with criticality ratings, completed assessments, risk acceptances and monitoring records for key suppliers.
Common gaps. Organisations often assess suppliers only at onboarding, overlook sub-tier suppliers and software components, and lack a plan for when a critical supplier is compromised or fails.