The process of identifying, assessing, and mitigating the risks associated with the global and distributed nature of information and communications technology product and service supply chains.
Sources:
NIST SP 800-18r2 under supply chain risk management from OMB Circular A-130 (2016)
NIST SP 800-37 Rev. 2 under supply chain risk management from OMB Circular A-130 (2016)

  A systematic process for managing cyber supply chain risk exposures, threats, and vulnerabilities throughout the supply chain and developing risk response strategies to the risks presented by the supplier, the supplied products and services, or the supply chain.
Sources:
NIST SP 800-53 Rev. 5 under supply chain risk management
NIST SP 800-53A Rev. 5 under supply chain risk management

  A systematic process for managing exposure to cybersecurity risks throughout the supply chain and developing appropriate response strategies, policies, processes, and procedures.
Sources:
NIST SP 800-18r2 under cybersecurity supply chain risk management from NIST SP 800-161r1-upd1