This is a potential security issue, you are being redirected to https://csrc.nist.gov.
Date Published: October 28, 2021
Comments Due: December 10, 2021 (public comment period is CLOSED)
Email Questions to: firstname.lastname@example.org
Planning Note (12/1/2021):
The comment period has been extended through December 10, 2021. The comment template has been updated to remove incorrect cell value validations from the Section and Page columns. NIST held a webinar on December 1, 2021, to provide an overview of the changes made in this draft.
The comment period has been extended through December 10, 2021.
The comment template has been updated to remove incorrect cell value validations from the Section and Page columns.
NIST held a webinar on December 1, 2021, to provide an overview of the changes made in this draft.
, , , , ,
NIST has just released the second public draft of Special Publication (SP) 800-161 Revision 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, for public comment. We listened to your comments from earlier this year about the first version, we’ve made new changes, and we are hoping to get your feedback again on our new draft.
The initial public draft was published in April of 2021 and preceded the release of the President’s Executive Order (EO) 14028 on Improving the Nation’s Cybersecurity issued on May 12, 2021. This EO charged multiple agencies—including NIST—with enhancing cybersecurity through a variety of initiatives, but with a specific focus on the security and integrity of the software supply chain.
What is different about this second version?
We worked on making the implementation guidance more consumable by different audiences by revising the structure of the document and adding Audience Profiles. We also added two NEW appendices focused more specifically on Federal departments and agencies:
See the "Note to Reviewers" on page iii of the draft for a summary of changes and questions for reviewers to consider.
How are comments submitted?
Comments are due by December 10
December 3, 2021. We encourage you to use this comment template for submitting your comments. As always, we are thankful for your support; your ideas will continue to help shape our final publication to ensure it meets the needs and expectations of our customers. We plan to release a final draft of NIST SP 800-161 Revision 1 during the third quarter of 2022.
NOTE: A call for patent claims is included on page vi of this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy--Inclusion of Patents in ITL Publications.
SP 800-161 Rev. 1 (Draft) (DOI)
Comment template (xls)
NIST’s Cyber Supply Chain Risk Management Program (other)
02/04/20: SP 800-161 Rev. 1 (Draft)
04/29/21: SP 800-161 Rev. 1 (Draft)
10/28/21: SP 800-161 Rev. 1 (Draft)
05/05/22: SP 800-161 Rev. 1 (Final)
Security and Privacy
cybersecurity supply chain risk management