NIST publishes guidance on cyber supply chain risk management

Published: Tuesday, 16 February 2021 09:40

The US NIST has announced the publication of NISTIR 8276, ‘Key Practices in Cyber Supply Chain Risk Management (C-SCRM): Observations from Industry’. This aims to provide digital businesses with a set of Key Practices that can be used to manage cyber security risks associated with their supply chains.

The document’s abstract reads as follows:

In today’s highly connected, interdependent world, all organizations rely on others for critical products and services. However, the reality of globalization, while providing many benefits, has resulted in a world where organizations no longer fully control—and often do not have full visibility into—the supply ecosystems of the products that they make or the services that they deliver. With more and more businesses becoming digital, producing digital products and services, and moving their workloads to the cloud, the impact of a cybersecurity event today is greater than ever before and could include personal data loss, significant financial losses, compromise of product integrity or safety, and even loss of life. Organizations can no longer protect themselves by simply securing their own infrastructures since their electronic perimeter is no longer meaningful; threat actors intentionally target the suppliers of more cyber-mature organizations to take advantage of the weakest link.

That is why identifying, assessing, and mitigating cyber supply chain risks is a critical capability to ensure business resilience. The multidisciplinary approach to managing these types of risks is called Cyber Supply Chain Risk Management (C-SCRM). This document provides the ever-increasing community of digital businesses a set of Key Practices that any organization can use to manage cybersecurity risks associated with their supply chains. The Key Practices presented in this document can be used to implement a robust C-SCRM function at an organization of any size, scope, and complexity. These practices combine the information contained in existing C-SCRM government and industry resources with the information gathered during the 2015 and 2019 NIST research initiatives.

The Key Practices identified in the document are:

Each Key Practice includes a number of recommendations that 'synthesize how these practices can be implemented from a people, process, and technology perspective'.

Read the document (PDF).