National Institute of Standards and Technology (NIST) publishes NIST 800-171 which is a set of guidelines designed to enhance the cybersecurity posture of organizations handling Controlled Unclassified Information (CUI). For NIST 800-171 R3 Final Public Draft (FPD), proposed control 3.17.1 will require a Supply Chain Risk Management (SCRM) Plan as part of an organization’s cybersecurity program.

In simple terms, a SCRM Plan is a strategic approach to identifying, assessing, and mitigating risks within an organization's supply chain. The goal of an SCRM Plan is to enhance the resilience of the supply chain by proactively addressing vulnerabilities and potential disruptions that could impact the organization's operations, reputation, and security. The expectation is this will stay in NIST 800-171, so it is important to start your journey now to develop and operationalize a SCRM Plan.

Tom Cornelius, the Senior Partner at ComplianceForge, explains, “There several ways that a ‘SCRM Plan’ may be approached so it will depend on guidance (if it even comes) from the DoD and/or NIST about what is the minimal expectation for the content and format associated with a SCRM Plan. This may be alignment with NIST 800-161 Rev 1, which is the ‘gold standard for SCRM’ that is also written by NIST. It may also be a SCRM Plan based on DI-MGMT-8225A. Only time will tell which approach is necessary to comply with NIST 800-171.”

Regardless if NIST 800-161 or DI-MGMT-8225A are used to guide the development of the SCRM Plan, key components of developing and implementing a SCRM Plan realistically include:

• Risk Identification: Identifying and cataloging potential risks within the supply chain, including cybersecurity threats, geopolitical issues, natural disasters, regulatory changes, and other factors that could impact the organization.
• Risk Assessment: Evaluating the identified risks based on their likelihood of occurrence and potential impact. This involves assessing the vulnerabilities and weaknesses in the supply chain that could be exploited by various threats.
• Risk Mitigation Strategies: Developing and implementing strategies to mitigate the identified risks. This may involve establishing controls, implementing best practices, conducting due diligence on suppliers, and developing contingency plans to respond to potential disruptions.
• Continuous Monitoring: Implementing a system for continuous monitoring and assessment of the supply chain. This includes regular reviews of supplier performance, monitoring for changes in the risk landscape, and staying informed about emerging threats.
• Supplier Engagement and Collaboration: Establishing communication channels with suppliers and fostering collaboration to ensure they adhere to security and compliance standards. This may include contractual agreements that outline cybersecurity requirements and expectations.
• Compliance with Regulations: Ensuring that the supply chain adheres to relevant regulations and standards. In many industries, compliance with specific cybersecurity frameworks and regulations is a crucial aspect of supply chain risk management.
• Incident Response Planning: Developing incident response plans specific to potential supply chain disruptions. This involves outlining the steps to be taken in the event of a security incident or other disruptions, with a focus on minimizing the impact on operations.
• Training and Awareness: Providing training and raising awareness among employees and supply chain partners about the importance of supply chain security. This includes educating stakeholders on security best practices, policies, and the role they play in maintaining a secure supply chain.
• Performance Metrics and Reporting: Establishing Key Performance Indicators (KPIs) and metrics to measure the effectiveness of the SCRM plan. Regular reporting on the status of the supply chain's security and risk mitigation efforts helps track progress and identify areas for improvement.

Beyond the scope of NIST 800-171, a SCRM Plan makes sense for businesses of any size or industry. A SCRM Plan is important for organizations, especially those operating in sectors where the supply chain plays a critical role since it can help build a resilient and secure supply chain ecosystem, protecting against various threats and ensuring the continuity of business operations. Additionally, with the increasing focus on cybersecurity and regulatory compliance, SCRM plans are becoming integral to overall risk management strategies.