[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-sp\u002F800-161":3},{"item":4,"lessons":16,"controls":66,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-sp","800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",800,"US National Institute of Standards and Technology (NIST)","**What it covers.** NIST guidance on identifying, assessing and responding to cybersecurity risks that come from suppliers, products and services across the supply chain. It sets out how to embed supply chain risk management at the enterprise, mission and system levels, and provides a tailored set of controls building on SP 800-53.\n\n**In practice.** Organisations establish a programme with clear ownership, tier suppliers by criticality and apply proportionate assessment before contracting and throughout the relationship. Contracts carry security requirements such as notification duties and the right to request evidence. Useful evidence includes a supplier inventory with criticality ratings, completed assessments, risk acceptances and monitoring records for key suppliers.\n\n**Common gaps.** Organisations often assess suppliers only at onboarding, overlook sub-tier suppliers and software components, and lack a plan for when a critical supplier is compromised or fails.",null,"https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F161\u002Fr1\u002Fupd1\u002Ffinal","Read the publication at NIST","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"ad-network-used-as-zero-click-spyware-delivery-channel-via-real-time-bidding","Ad Network Used as Zero-Click Spyware Delivery Channel via Real-Time Bidding","2026-10-17T12:20:32.316+00:00",{"slug":23,"title":24,"published_at":25},"malicious-npm-package-imgdecode-delivers-hidden-shellcode-loader","Malicious npm Package 'imgdecode' Delivers Hidden Shellcode Loader","2026-10-17T12:20:17.17+00:00",{"slug":27,"title":28,"published_at":29},"compromised-connectwise-credential-exposes-173-microsoft-365-tenants","Compromised ConnectWise Credential Exposes 173 Microsoft 365 Tenants","2026-10-17T08:20:20.122+00:00",{"slug":31,"title":32,"published_at":33},"fake-ai-brand-impersonation-campaigns-target-enterprise-developers","Fake AI Brand Impersonation Campaigns Target Enterprise Developers","2026-10-16T22:20:50.472+00:00",{"slug":35,"title":36,"published_at":37},"aomei-backupper-update-servers-hijacked-to-distribute-backdoor","AOMEI Backupper Update Servers Hijacked to Distribute Backdoor","2026-10-16T18:21:08.893+00:00",{"slug":39,"title":40,"published_at":41},"bae-systems-breach-cripples-us-bankruptcy-court-noticing-system","BAE Systems Breach Cripples US Bankruptcy Court Noticing System","2026-10-16T16:20:16.497+00:00",{"slug":43,"title":44,"published_at":45},"ransomware-negotiator-secretly-worked-for-the-attackers","Ransomware Negotiator Secretly Worked for the Attackers","2026-10-16T15:20:17.253+00:00",{"slug":47,"title":48,"published_at":49},"bae-systems-contractor-incident-cripples-us-bankruptcy-court-notifications","BAE Systems Contractor Incident Cripples US Bankruptcy Court Notifications","2026-10-16T12:20:16.174+00:00",{"slug":51,"title":52,"published_at":53},"bae-systems-breach-disrupts-federal-court-infrastructure-via-supply-chain-attack","BAE Systems Breach Disrupts Federal Court Infrastructure via Supply Chain Attack","2026-10-16T08:20:29.888+00:00",{"slug":55,"title":56,"published_at":57},"malicious-ad-networks-weaponized-to-silently-deploy-candiru-spyware","Malicious Ad Networks Weaponized to Silently Deploy Candiru Spyware","2026-10-15T22:20:22.695+00:00",{"slug":59,"title":60,"published_at":61},"ai-powered-oss-scanner-fast-tracks-vulnerability-disclosure-for-open-source-maintainers","AI-Powered OSS Scanner Fast-Tracks Vulnerability Disclosure for Open Source Maintainers","2026-10-15T20:21:23.114+00:00",{"slug":63,"title":64,"published_at":65},"malicious-aur-packages-execute-root-level-malware-via-typosquatting","Malicious AUR Packages Execute Root-Level Malware via Typosquatting","2026-10-15T18:20:20.988+00:00",[67,72,77,82,87,92],{"slug":68,"name":69,"problem":70,"stories":71},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",429,{"slug":73,"name":74,"problem":75,"stories":76},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",303,{"slug":78,"name":79,"problem":80,"stories":81},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",193,{"slug":83,"name":84,"problem":85,"stories":86},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",162,{"slug":88,"name":89,"problem":90,"stories":91},"patch-management","Automated patch management","Known holes get closed in days, not months.",115,{"slug":93,"name":94,"problem":95,"stories":96},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",100,[98,104,109,115,121,126,131,137],{"family":99,"item":100,"code":101,"title":102,"together":103},"cis","2","Control 2","Inventory and Control of Software Assets",535,{"family":99,"item":105,"code":106,"title":107,"together":108},"16","Control 16","Application Software Security",297,{"family":110,"item":111,"code":112,"title":113,"together":114},"slsa","overview","SLSA","SLSA (Supply-chain Levels for Software Artifacts)",272,{"family":116,"item":117,"code":118,"title":119,"together":120},"gdpr","32","Article 32","Security of processing",242,{"family":5,"item":122,"code":123,"title":124,"together":125},"800-218","SP 800-218","SP 800-218: Secure Software Development Framework (SSDF) Version 1.1",233,{"family":99,"item":127,"code":128,"title":129,"together":130},"7","Control 7","Continuous Vulnerability Management",226,{"family":132,"item":133,"code":134,"title":135,"together":136},"nist-800-53","sa-12","SA-12","Supply Chain Protection",199,{"family":138,"item":139,"code":140,"title":141,"together":142},"nist-csf","id-sc","ID.SC-4","Supply Chain Risk Management (CSF 1.1)",158]