U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.


Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

NISTIR 8272 (Draft)

Impact Analysis Tool for Interdependent Cyber Supply Chain Risks

Date Published: March 2020
Comments Due: April 17, 2020 (public comment period is CLOSED)
Email Questions to: scrm-nist@nist.gov


Celia Paulsen (NIST), Kris Winkler (Boston Consulting Group), Jon Boyens (NIST), Jeffrey Ng (Boston Consulting Group), James Gimbi (Boston Consulting Group)


This draft document describes a prototype tool developed to show a possible solution for filling the gap between an organization's risk appetite and supply chain risk posture by providing a basic measurement of the potential impact of a cyber supply chain event. This tool does not represent a complete supply chain risk management solution, but is intended to be integrated into or used in concert with tools such as third-party management, enterprise resource planning, and supply chain management efforts. Comments related to additional functionality or other aspects of the tool may be used to develop future versions of the software.



C-SCRM; cyber supply chain risk management; risk management; secure supply chain; supply chain; supply chain assurance; supply chain dependencies; supply chain risk; supply chain risk management; supply chain security
Control Families

System and Services Acquisition