United States (federal) · guidance
C-SCRM: what it requires, and the records to keep
SP 800-161 Rev. 1 tells organizations how to identify, assess and reduce cybersecurity risks across their supply chains, from counterfeit or tampered products to weak supplier development practices. It builds on the SR control family in SP 800-53 and applies to AI models, data and services bought from third parties.
01 / What it requires
What C-SCRM requires
Federal agencies managing cybersecurity risk in the products and services they acquire, and by extension their suppliers; usable by any organization.
- 01Set a C-SCRM strategy, policy and implementation plan at enterprise, mission and system levels.
- 02Assess supply chain risk for products and services before and during acquisition.
- 03Apply and tailor supply chain controls (SP 800-53 SR family and enhanced overlays) to systems.
- 04Flow C-SCRM requirements into supplier contracts and monitor supplier compliance.
- 05Maintain visibility into components, provenance and suppliers, and respond to supply chain incidents.
02 / AI work
Where it touches AI work
Third-party models, training data, AI APIs and AI-enabled software are supply chain elements under this guidance. It contains no AI-specific controls.
03 / Dates
The dates that matter
Original SP 800-161 published
Rev. 1 published, implementing EO 14028 supply chain tasks
Rev. 1 Update 1 (errata) replaces original Rev. 1
Fillable SCRM assessment scoping questionnaire released
04 / Enforcement
Who enforces it
None directly; applied through agency risk management under FISMA and through contract terms.
05 / Records
Records an organisation keeps
What an auditor or an inquiry usually asks to see. Your obligations depend on your role and your facts.
- 01C-SCRM strategy, policy and implementation plan
- 02Supplier risk assessments and completed scoping questionnaires
- 03Contract clauses flowing down supply chain requirements
- 04Component inventories, SBOMs and provenance records
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
CHANGE LOG
What changed, and when
Rebuilt from primary sources; facts checked on this date.
Related: C-SCRM vs SBOM · C-SCRM vs SSDF SP 800-218 · C-SCRM for defense AI workflows · SBOM · AI Citation Sanctions · Proctoring Fairness