C-SCRM for a mid-tier defense prime: NIST SP 800-161 in practice

Cybersecurity supply chain risk management (C-SCRM) is the practice NIST SP 800-161 Rev 1 describes: knowing who your suppliers are, assessing the risk each one brings, writing the response down in a plan, and watching it. For a mid-tier defense prime today, CMMC does not score one: CMMC Level 2 is NIST SP 800-171 Rev 2, which has no supply chain family. Rev 3 adds one, and Executive Order 14415 directs regulations that will require mapping and vetting at every tier. Build the program now, at the size of your supplier base.

This guide explains the rules as of October 21, 2026. It is not legal advice: the clauses in your contract decide what applies to you.

What is NIST SP 800-161?

NIST SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, was published in May 2022 and carries updates as of November 1, 2024. Its abstract says it "provides guidance to organizations on identifying, assessing, and mitigating cybersecurity risks throughout the supply chain at all levels of their organizations" and that it "integrates cybersecurity supply chain risk management (C-SCRM) into risk management activities by applying a multilevel, C-SCRM-specific approach, including guidance on the development of C-SCRM strategy implementation plans, C-SCRM policies, C-SCRM plans, and risk assessments for products and services."

It is guidance for organizations of any kind, not a contract requirement. NIST SP 800-171 Rev 2, the standard behind CMMC Level 2, cites it in the discussions of 3.6.1 and 3.14.3: "[SP 800-161] provides guidance on supply chain risk management."

The three levels

Section 2.3 takes the structure of NIST SP 800-39: "three levels, depicted in Fig. 5, that address risk from different perspectives: 1) the enterprise level, 2) the mission and business process level, and 3) the operational level. C-SCRM requires the involvement of all three levels." Each level produces something:

What a C-SCRM plan contains

Section 2.3.4 calls the plan "A critical Level 3 activity" and says it "includes information on the system, its categorization, operational status, related agreements, architecture, critical system personnel, related laws, regulations, policies, and contingency plan." The plan "is a living document", and such plans "are not intended to be documents developed to satisfy a compliance requirement."

Appendix D.3.1 gives a fourteen-section template, from System Name and Identifier and System Description, through System/Network Diagrams, Inventory, and Life Cycle Activities, Security Control Details and Role Identification, to C-SCRM Plan Approval, Acronym List and Attachments. Appendix D says the plan "can either be stand-alone or a component of a system security and privacy plan. If incorporated, the C-SCRM components must be clearly discernable." For a prime that already keeps a system security plan for NIST SP 800-171, that is the natural home.

NIST SP 1326: due diligence on a supplier

NIST SP 1326, NIST Cybersecurity Supply Chain Risk Management: Due Diligence Assessment Quick-Start Guide, was published in final form in July 2026 (document history: July 8, 2026). It describes itself as "a supplement to the content within SP 800-161 Revision 1" that "is not intended to replace it", and it is scoped "to information and communications technology (ICT) suppliers".

Due diligence, it says, is the minimum amount of reasonable research an acquirer should conduct on a supplier, and "It should be done with most of the acquiring organization's suppliers, prioritized by criticality, prior to a more fulsome supplier review." It distinguishes two depths: "Basic due diligence is desktop-based research using publicly available information (PAI) to derive findings, as opposed to contacting suppliers requesting information", while commercial datasets and illumination tools are "enhanced due diligence".

The research falls into five categories: "Foreign Ownership, Control, or Influence (FOCI); Provenance; Resilience; Foundational Cyber Practices; and Supply Chain Tiers." Its pre-checks start from sources a prime already has, among them SAM.gov's "entity exclusions from USG procurement actions". On tiers: "First-tier suppliers provide products and/or services directly to the end user. Second-tier suppliers provide products and/or services to first-tier suppliers." and going further down "increases one's visibility and understanding, but the difficulty and cost exponentially increase."

Does CMMC require supply chain risk management?

Not at Level 2 as it stands. Under 32 CFR 170.14(c)(3), "The security requirements in CMMC Level 2 are identical to the requirements in NIST SP 800-171 R2." Rev 2 organizes its 110 requirements into fourteen families: Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, and System and Information Integrity. Supply chain is not one of them.

NIST SP 800-171 Rev. 3 (May 2024) adds a Supply Chain Risk Management family, 3.17, with three requirements:

• 03.17.01, Supply Chain Risk Management Plan: "Develop a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations, maintenance, and disposal of the system, system components, or system services", review and update it at an organization-defined frequency, and "Protect the supply chain risk management plan from unauthorized disclosure."
• 03.17.02, Acquisition Strategies, Tools, and Methods: "Develop and implement acquisition strategies, contract tools, and procurement methods to identify, protect against, and mitigate supply chain risks."
• 03.17.03, Supply Chain Requirements and Processes: "Establish a process for identifying and addressing weaknesses or deficiencies in the supply chain elements and processes" and enforce organization-defined security requirements against supply chain risks.

Rev 3's discussion of 03.17.01 says the plan "can either be stand-alone or incorporated into system security plans". Whether and when Rev 3 reaches DoD contracts is the subject of NIST SP 800-171 Rev 2 vs Rev 3; until it does, a C-SCRM plan is good practice for a CMMC Level 2 company, not a scored requirement.

Executive Order 14415: mapping and vetting are coming

Executive Order 14415 of July 20, 2026 directs the Secretary of War, within 180 days, to "develop policy and implementation guidance to require all prime contractors and subcontractors at any tier to map and illuminate" critical supply chains, and says the regulations that follow shall require contractors to "establish and implement written procedures" to "proactively vet all suppliers and subcontractors that support the critical supply chain", screening for financial risk, FOCI, and manufacturing and supply risk. After vetting, contractors would have 15 days to notify the Department of significant risks and 45 days to submit a corrective action plan. None of that is in a contract yet; what is in force, and the dates, are in Executive Order 14415 explained.

What a 50-supplier prime can do this quarter

1. Map the first tier from the public record. Your reported subawards on USAspending.gov and your suppliers' SAM.gov registrations give the first tier with UEIs; see How to find a company's subcontractors on USAspending.gov. Add the suppliers the record misses: under-threshold, second tier, vendors.
2. Write the policy on one page. Level 1 in SP 800-161's terms: who owns supplier risk, what you screen for (the EO 14415 three or the SP 1326 five), and what you ask a supplier for before award.
3. Do basic due diligence on every supplier, prioritized by criticality: SAM.gov status and exclusions, the supplier's observable public security posture, ownership and location.
4. Ask each supplier what it attests, signed: DFARS 252.204-7012 status, NIST SP 800-171 self-assessment, SPRS score, system security plan, incident reporting readiness. How primes check their suppliers' cybersecurity lists the questions.
5. Keep a register. One line per risk with a severity, an owner, a status and a mitigation; see How to keep a supplier risk register.
6. Write the plan from what you now have, under SP 800-161's Appendix D headings or inside your system security plan, with a review date.

Where Tiermark fits

Tiermark's supplier map builds the first tier from USAspending subawards and SAM.gov registrations and grades each supplier from passive observation of its public DNS, mail authentication, certificates and TLS; the grade is an observation, not a compliance determination. Campaigns collect a signed DFARS 252.204-7012 attestation from each supplier. The risk register derives items from signed answers and high or critical findings, takes hand-entered items, and, when you mark vetting complete, runs the 15-day and 45-day clocks. An audit package puts the attestations, the request ledger and the register in one hashed file. Tiermark does not write a C-SCRM plan, produce a bill of materials, or screen for FOCI or financial distress.

Sources

• NIST SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, May 2022, updated November 1, 2024: abstract, Section 2.3, Section 2.3.4, Appendix D.3
• NIST SP 1326, NIST Cybersecurity Supply Chain Risk Management: Due Diligence Assessment Quick-Start Guide, July 2026
• NIST SP 800-171 Rev. 2, Table 1 and the discussions of 3.6.1 and 3.14.3
• NIST SP 800-171 Rev. 3, Section 3.17
• 32 CFR 170.14, CMMC Model
• Executive Order 14415, Federal Register, 91 FR 46693, document 2026-15003