CLAIMBOUND / SOURCE-PUBLICATION EVIDENCE
Software supply chain
Every card identifies what it proves, what it does not prove, its exact quote, locator, source hash, and local rerun command.
1. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 13
Narrow public claim
Given the definition of supply chain, cybersecurity risks throughout the supply chain2,3 refers to the potential for harm or compromise that may arise from suppliers, their supply chains, their products, or their services.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 13- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Given the definition of supply chain, cybersecurity risks throughout the supply chain2,3 refers to the potential for harm or compromise that may arise from suppliers, their supply chains, their products, or their services.
2. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 13
Narrow public claim
In the 2015 version of SP 800-161, NIST used the term “ICT supply chain.” In this revision, NIST has intentionally moved away from this term as cybersecurity risks can arise in all product and service supply chains, including both ICT and non-technology supply chains.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 13- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
In the 2015 version of SP 800-161, NIST used the term “ICT supply chain.” In this revision, NIST has intentionally moved away from this term as cybersecurity risks can arise in all product and service supply chains, including both ICT and non-technology supply chains.
3. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 15
Narrow public claim
By this definition, an enterprise is an organization, but it exists at the top level of the hierarchy where individual senior leaders have unique risk management responsibilities [NISTIR 8286].
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 15- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
By this definition, an enterprise is an organization, but it exists at the top level of the hierarchy where individual senior leaders have unique risk management responsibilities [NISTIR 8286].
4. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 15
Narrow public claim
In these cases, an enterprise may have multiple Level 1s with stakeholders and activities defined at both the enterprise and the organization levels.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 15- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
In these cases, an enterprise may have multiple Level 1s with stakeholders and activities defined at both the enterprise and the organization levels.
5. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 16
Narrow public claim
To that end, this publication describes C-SCRM practices observed in enterprises and offers a general prioritization of C-SCRM practices (i.e., Foundational, Sustaining, Enabling)4 for enterprises to consider as they implement and mature C-SCRM.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 16- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
To that end, this publication describes C-SCRM practices observed in enterprises and offers a general prioritization of C-SCRM practices (i.e., Foundational, Sustaining, Enabling)4 for enterprises to consider as they implement and mature C-SCRM.
6. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 18
Narrow public claim
In smaller enterprises, these personnel may bear the responsibility for implementing C-SCRM and should refer to Section 1.3.1 for guidance.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 18- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
In smaller enterprises, these personnel may bear the responsibility for implementing C-SCRM and should refer to Section 1.3.1 for guidance.
7. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 21
Narrow public claim
These information systems and networks are composed of ICT/OT10 products and components made available by suppliers, developers, and system integrators.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 21- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
These information systems and networks are composed of ICT/OT10 products and components made available by suppliers, developers, and system integrators.
8. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 24
Narrow public claim
When possible and appropriate, acquirers should allow suppliers, developers, system integrators, external system service providers, and other ICT/OT-related service providers the opportunity to reuse applicable existing data and documentation that may provide evidence to support C-SCRM (e.g., certification of a vendor to a relevant standard, such as ISO 27001).
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 24- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
When possible and appropriate, acquirers should allow suppliers, developers, system integrators, external system service providers, and other ICT/OT-related service providers the opportunity to reuse applicable existing data and documentation that may provide evidence to support C-SCRM (e.g., certification of a vendor to a relevant standard, such as ISO 27001).
9. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 25
Narrow public claim
Methodology for Building C-SCRM Guidance Using NIST SP 800-39; NIST SP 80037, Rev 2; and NIST SP 800-53, Rev 5 This publication applies the multilevel risk management approach of [NIST SP 800-39] by providing C-SCRM guidance at the enterprise, mission, and operational levels.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 25- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Methodology for Building C-SCRM Guidance Using NIST SP 800-39; NIST SP 80037, Rev 2; and NIST SP 800-53, Rev 5 This publication applies the multilevel risk management approach of [NIST SP 800-39] by providing C-SCRM guidance at the enterprise, mission, and operational levels.
10. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 25
Narrow public claim
For individual systems, this guidance is recommended for use with information systems at all impact categories, according to [FIPS 199].
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 25- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
For individual systems, this guidance is recommended for use with information systems at all impact categories, according to [FIPS 199].
11. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 26
Narrow public claim
SP 800-53B, Control Baselines for Information Systems and Organizations: Provides security and privacy control baselines for the Federal Government.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 26- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
SP 800-53B, Control Baselines for Information Systems and Organizations: Provides security and privacy control baselines for the Federal Government.
12. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 27
Narrow public claim
NISTIR 7622, Notional Supply Chain Risk Management Practices for Federal Information Systems: Provides a wide array of practices that help mitigate supply chain risk to federal information systems.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 27- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
NISTIR 7622, Notional Supply Chain Risk Management Practices for Federal Information Systems: Provides a wide array of practices that help mitigate supply chain risk to federal information systems.
13. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 27
Narrow public claim
NISTIR 8179, Criticality Analysis Process Model: Prioritizing Systems and Components: Helps organizations identify those systems and components that are most vital and which may need additional security or other protections.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 27- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
NISTIR 8179, Criticality Analysis Process Model: Prioritizing Systems and Components: Helps organizations identify those systems and components that are most vital and which may need additional security or other protections.
14. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 34
Narrow public claim
At Level 1 (Enterprise), the overall C-SCRM strategy, policy, and implementation plan set the tone, governance structure, and boundaries for how C-SCRM is managed across the enterprise and guide C-SCRM activities performed at the mission and business process levels.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 34- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
At Level 1 (Enterprise), the overall C-SCRM strategy, policy, and implementation plan set the tone, governance structure, and boundaries for how C-SCRM is managed across the enterprise and guide C-SCRM activities performed at the mission and business process levels.
15. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 35
Narrow public claim
At Level 3 (Operational), the C-SCRM plans provide the basis for determining whether an information system meets business, functional, and technical requirements and includes appropriately tailored controls.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 35- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
At Level 3 (Operational), the C-SCRM plans provide the basis for determining whether an information system meets business, functional, and technical requirements and includes appropriately tailored controls.
16. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 39
Narrow public claim
Level 1 – Enterprise Effective C-SCRM requires commitment, direct involvement, and ongoing support from senior leaders and executives.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 39- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Level 1 – Enterprise Effective C-SCRM requires commitment, direct involvement, and ongoing support from senior leaders and executives.
17. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 40
Narrow public claim
Within Level-1, governance structures are formed to enable senior leaders and executives to collaborate on C-SCRM with the risk executive (function), make C-SCRM decisions, delegate decisions to Level 2 and Level 3, and prioritize enterprise-wide resource allocation for C-SCRM.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 40- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Within Level-1, governance structures are formed to enable senior leaders and executives to collaborate on C-SCRM with the risk executive (function), make C-SCRM decisions, delegate decisions to Level 2 and Level 3, and prioritize enterprise-wide resource allocation for C-SCRM.
18. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 40
Narrow public claim
Level 1 activities culminate in the C-SCRM Strategy, Policy, and High-Level Implementation Plan that shape and constrain how C-SCRM is carried out at Level 2 and Level 3.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 40- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Level 1 activities culminate in the C-SCRM Strategy, Policy, and High-Level Implementation Plan that shape and constrain how C-SCRM is carried out at Level 2 and Level 3.
19. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 41
Narrow public claim
C-SCRM framing is the process by which the enterprise makes explicit the assumptions about cybersecurity risks throughout the supply chain (e.g., threats, vulnerabilities, risk impact,21 risk likelihood), constraints (e.g., enterprise policies, regulations, resource limitation, etc.), appetite and tolerance, and priorities and trade-offs that guide C-SCRM decisions across the enterprise.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 41- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
C-SCRM framing is the process by which the enterprise makes explicit the assumptions about cybersecurity risks throughout the supply chain (e.g., threats, vulnerabilities, risk impact,21 risk likelihood), constraints (e.g., enterprise policies, regulations, resource limitation, etc.), appetite and tolerance, and priorities and trade-offs that guide C-SCRM decisions across the enterprise.
20. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 42
Narrow public claim
Level 1 risk assessments may be based on the enterprise’s Level 1 Frame step (i.e., assumptions, constraints, appetite, tolerances, priorities, and trade-offs) or may be aggregated enterprise-level assumptions based on risk assessments that are completed across multiple mission and business processes.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 42- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Level 1 risk assessments may be based on the enterprise’s Level 1 Frame step (i.e., assumptions, constraints, appetite, tolerances, priorities, and trade-offs) or may be aggregated enterprise-level assumptions based on risk assessments that are completed across multiple mission and business processes.
21. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 42
Narrow public claim
Level 1 risk assessments may also aim to aggregate and recontextualize risk assessments completed at Level 2 to describe risk scenarios against the enterprise’s primary objectives.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 42- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Level 1 risk assessments may also aim to aggregate and recontextualize risk assessments completed at Level 2 to describe risk scenarios against the enterprise’s primary objectives.
22. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 43
Narrow public claim
Level 2 roles include representatives of each mission and business process, such as program managers, research and development, and acquisitions/procurement.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 43- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Level 2 roles include representatives of each mission and business process, such as program managers, research and development, and acquisitions/procurement.
23. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 43
Narrow public claim
To facilitate the development and execution of Level 2 Strategy and Implementation plans, enterprises may benefit from forming a committee with representation from each mission and business process.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 43- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
To facilitate the development and execution of Level 2 Strategy and Implementation plans, enterprises may benefit from forming a committee with representation from each mission and business process.
24. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 44
Narrow public claim
Topics covered at Level 2 will reflect those covered at Level 1 but should be reshaped to focus on the specific mission and business process that they correspond to.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 44- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Topics covered at Level 2 will reflect those covered at Level 1 but should be reshaped to focus on the specific mission and business process that they correspond to.
25. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 44
Narrow public claim
Level 2 reporting should include metrics that demonstrate the mission and business process performance in contrast to the enterprise-defined risk appetite and risk tolerance statements defined at Level 1 and Level 2.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 44- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Level 2 reporting should include metrics that demonstrate the mission and business process performance in contrast to the enterprise-defined risk appetite and risk tolerance statements defined at Level 1 and Level 2.
26. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 45
Narrow public claim
These plans are heavily influenced by assumptions, constraints, risk appetite and tolerance, priorities, and trade-offs defined by Level 1 and Level 2.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 45- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
These plans are heavily influenced by assumptions, constraints, risk appetite and tolerance, priorities, and trade-offs defined by Level 1 and Level 2.
27. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 45
Narrow public claim
Risk response is achieved by selecting, tailoring, implementing, and monitoring C-SCRM controls throughout the SLDC in accordance with the RMF [NIST 800-37r2].
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 45- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Risk response is achieved by selecting, tailoring, implementing, and monitoring C-SCRM controls throughout the SLDC in accordance with the RMF [NIST 800-37r2].
28. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 46
Narrow public claim
Regardless of whether a CSCRM PMO sits at Level 1 or Level 2, it is critical that the C-SCRM PMO include crossdisciplinary representation.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 46- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Regardless of whether a CSCRM PMO sits at Level 1 or Level 2, it is critical that the C-SCRM PMO include crossdisciplinary representation.
29. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 46
Narrow public claim
The C-SCRM PMO may provide SME support to guide Level 1 stakeholders through the risk framing process, which includes establishing the enterprise appetite and tolerance for cybersecurity risks throughout the supply chain.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 46- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The C-SCRM PMO may provide SME support to guide Level 1 stakeholders through the risk framing process, which includes establishing the enterprise appetite and tolerance for cybersecurity risks throughout the supply chain.
30. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 47
Narrow public claim
At Level 2, the C-SCRM PMO may develop C-SCRM starter kits that contain a base strategy and a set of policies, procedures, and guidelines that can be further customized within specific mission and business processes.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 47- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
At Level 2, the C-SCRM PMO may develop C-SCRM starter kits that contain a base strategy and a set of policies, procedures, and guidelines that can be further customized within specific mission and business processes.
31. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 47
Narrow public claim
The responsibility of a C-SCRM PMO at Level 1 and Level 2 would ultimately influence CSCRM activities at the Level 3 operational level.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 47- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The responsibility of a C-SCRM PMO at Level 1 and Level 2 would ultimately influence CSCRM activities at the Level 3 operational level.
32. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 48
Narrow public claim
As described in [NIST SP 800-39], multilevel risk management is the purposeful execution and continuous improvement of cybersecurity supply chain risk management activities at the enterprise (e.g., CEO, COO), mission and business process (e.g., business management, R&D), and operational (e.g., systems management) levels.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 48- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
As described in [NIST SP 800-39], multilevel risk management is the purposeful execution and continuous improvement of cybersecurity supply chain risk management activities at the enterprise (e.g., CEO, COO), mission and business process (e.g., business management, R&D), and operational (e.g., systems management) levels.
33. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 49
Narrow public claim
C-SCRM in Acquisition25 Integrating C-SCRM considerations into acquisition activities within every step of the procurement and contract management life cycle process is essential to improving management of cybersecurity risks throughout the supply chain.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 49- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
C-SCRM in Acquisition25 Integrating C-SCRM considerations into acquisition activities within every step of the procurement and contract management life cycle process is essential to improving management of cybersecurity risks throughout the supply chain.
34. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 50
Narrow public claim
Additionally, by adopting C-SCRM controls aligned to an industry-recognized set of standards and guidelines (e.g., NIST 800-53, Rev.5; NIST CSF), the enterprise can ensure holistic coverage of cybersecurity risks throughout the supply chain and corresponding C-SCRM practices.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 50- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Additionally, by adopting C-SCRM controls aligned to an industry-recognized set of standards and guidelines (e.g., NIST 800-53, Rev.5; NIST CSF), the enterprise can ensure holistic coverage of cybersecurity risks throughout the supply chain and corresponding C-SCRM practices.
35. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 51
Narrow public claim
The Role of C-SCRM in the Acquisition Process When conducting a procurement, enterprises should designate experts from different subject matter areas to participate in the acquisition process as members of the Acquisition Team and/or Integrated Project Team.26 This includes program officials, personnel with technical and security expertise, and representatives from supply and procurement communities.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 51- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The Role of C-SCRM in the Acquisition Process When conducting a procurement, enterprises should designate experts from different subject matter areas to participate in the acquisition process as members of the Acquisition Team and/or Integrated Project Team.26 This includes program officials, personnel with technical and security expertise, and representatives from supply and procurement communities.
36. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 52
Narrow public claim
This contextual basis sets the stage for the Acquisition Team to effectively gauge their tolerance for risk as it pertains to a specific procurement requirement and determine which of the C-SCRM controls described in this document and [NIST SP 800-53 Rev 5] controls are relevant and necessary to consider for specific acquisitions.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 52- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
This contextual basis sets the stage for the Acquisition Team to effectively gauge their tolerance for risk as it pertains to a specific procurement requirement and determine which of the C-SCRM controls described in this document and [NIST SP 800-53 Rev 5] controls are relevant and necessary to consider for specific acquisitions.
37. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 52
Narrow public claim
Acquisition policies and processes need to incorporate C-SCRM considerations into each step of the procurement and contract management life cycle management process (i.e., plan procurement, define and develop requirements, perform market analysis, complete procurement, ensure compliance, and monitor performance for changes that affect C-SCRM risk status) as described in [NISTIR 7622].
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 52- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Acquisition policies and processes need to incorporate C-SCRM considerations into each step of the procurement and contract management life cycle management process (i.e., plan procurement, define and develop requirements, perform market analysis, complete procurement, ensure compliance, and monitor performance for changes that affect C-SCRM risk status) as described in [NISTIR 7622].
38. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 58
Narrow public claim
Enterprises should define baseline training requirements at a broad scope within Level 1, and those requirements should be tailored and refined based on the specific context within Level 2 and Level 3.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 58- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Enterprises should define baseline training requirements at a broad scope within Level 1, and those requirements should be tailored and refined based on the specific context within Level 2 and Level 3.
39. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 58
Narrow public claim
Enterprises are encouraged to utilize the NIST National Initiative for Cybersecurity Education (NICE) Framework30 as a means of forming a common lexicon for C-SCRM workforce topics.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 58- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Enterprises are encouraged to utilize the NIST National Initiative for Cybersecurity Education (NICE) Framework30 as a means of forming a common lexicon for C-SCRM workforce topics.
40. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 59
Narrow public claim
Establish and begin using supplier risk-assessment processes on a prioritized basis (inclusive of criticality analysis, threat analysis, and vulnerability analysis) after the [FIPS 199] impact level has been defined.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 59- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Establish and begin using supplier risk-assessment processes on a prioritized basis (inclusive of criticality analysis, threat analysis, and vulnerability analysis) after the [FIPS 199] impact level has been defined.
41. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 60
Narrow public claim
Establish a supplier management program that includes, for example, guidelines for purchasing from qualified original equipment manufacturers (OEMs)32 or their authorized distributors and resellers.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 60- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Establish a supplier management program that includes, for example, guidelines for purchasing from qualified original equipment manufacturers (OEMs)32 or their authorized distributors and resellers.
42. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 60
Narrow public claim
Use confidence-building mechanisms, such as third-party assessment surveys, on-site visits, and formal certifications (e.g., ISO 27001) to assess critical supplier security capabilities and practices.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 60- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Use confidence-building mechanisms, such as third-party assessment surveys, on-site visits, and formal certifications (e.g., ISO 27001) to assess critical supplier security capabilities and practices.
43. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 62
Narrow public claim
Progression against framework topics is measured using ordinal (i.e., 1-5) scales that illustrate the progression of capabilities across tiers.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 62- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Progression against framework topics is measured using ordinal (i.e., 1-5) scales that illustrate the progression of capabilities across tiers.
44. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 62
Narrow public claim
CSF Tier 3: The enterprise-wide approach to managing cybersecurity risks throughout the supply chain is enacted via enterprise risk management policies, processes, and procedures.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 62- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
CSF Tier 3: The enterprise-wide approach to managing cybersecurity risks throughout the supply chain is enacted via enterprise risk management policies, processes, and procedures.
45. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 77
Narrow public claim
As noted in Table A-1, C-SCRM controls in this publication are designated by the three levels comprising the enterprise.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 77- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
As noted in Table A-1, C-SCRM controls in this publication are designated by the three levels comprising the enterprise.
46. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 80
Narrow public claim
After selecting the initial set of security controls, the acquirer should initiate the tailoring process according to NIST SP 800-53B, Control Baselines for Information Systems and Organization, in order to appropriately modify and more closely align the selected controls with the specific conditions within the enterprise.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 80- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
After selecting the initial set of security controls, the acquirer should initiate the tailoring process according to NIST SP 800-53B, Control Baselines for Information Systems and Organization, in order to appropriately modify and more closely align the selected controls with the specific conditions within the enterprise.
47. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 85
Narrow public claim
Supplemental C-SCRM Guidance: The enterprise should ensure the separation of the information system and supply chain information36 flow.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 85- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Supplemental C-SCRM Guidance: The enterprise should ensure the separation of the information system and supply chain information36 flow.
48. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 98
Narrow public claim
Authorizing officials may use the guidance in Section 2 of this document as well as NISTIR 8179 to guide the assessment process.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 98- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Authorizing officials may use the guidance in Section 2 of this document as well as NISTIR 8179 to guide the assessment process.
49. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 105
Narrow public claim
Supplemental C-SCRM Guidance: If an enterprise uses an open source project that does not have an SBOM and the enterprise requires one, the enterprise will need to 1) contribute SBOM generation to the open source project, 2) contribute resources to the project to add this capability, or 3) generate an SBOM on their first consumption of each version of the open source project that they use.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 105- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Supplemental C-SCRM Guidance: If an enterprise uses an open source project that does not have an SBOM and the enterprise requires one, the enterprise will need to 1) contribute SBOM generation to the open source project, 2) contribute resources to the project to add this capability, or 3) generate an SBOM on their first consumption of each version of the open source project that they use.
50. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 121
Narrow public claim
At Level 1, the policy should explicitly assert that C-SCRM should be applied throughout the SDLC, including maintenance activities.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 121- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
At Level 1, the policy should explicitly assert that C-SCRM should be applied throughout the SDLC, including maintenance activities.
51. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 122
Narrow public claim
This control may be performed at both Level 2 and Level 3, depending on how an agency handles the acquisition, operations, and oversight of maintenance tools.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 122- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
This control may be performed at both Level 2 and Level 3, depending on how an agency handles the acquisition, operations, and oversight of maintenance tools.
52. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 124
Narrow public claim
In Level 2, agencies should track and communicate the failure rates to suppliers (OEM and/or an authorized distributor).
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 124- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
In Level 2, agencies should track and communicate the failure rates to suppliers (OEM and/or an authorized distributor).
53. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 124
Narrow public claim
The failure rates and the issues that can indicate failures, including root causes, should be identified by an enterprise’s technical personnel (e.g., developers, administrators, or maintenance engineers) in Level 3 and communicated to Level 2.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 124- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The failure rates and the issues that can indicate failures, including root causes, should be identified by an enterprise’s technical personnel (e.g., developers, administrators, or maintenance engineers) in Level 3 and communicated to Level 2.
54. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 131
Narrow public claim
The C-SCRM policy and procedures provide inputs into and take guidance from the C-SCRM Strategy and Implementation Plan at Level 1 and the System Security Plan and C-SCRM plan at Level 3.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 131- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The C-SCRM policy and procedures provide inputs into and take guidance from the C-SCRM Strategy and Implementation Plan at Level 1 and the System Security Plan and C-SCRM plan at Level 3.
55. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 131
Narrow public claim
The system security plan and/or system-level C-SCRM plan provide inputs into and take guidance from the C-SCRM Strategy and Implementation Plan at Level 1 and the C-SCRM policy at Level 1 and Level 2.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 131- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The system security plan and/or system-level C-SCRM plan provide inputs into and take guidance from the C-SCRM Strategy and Implementation Plan at Level 1 and the C-SCRM policy at Level 1 and Level 2.
56. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 133
Narrow public claim
Supplemental C-SCRM Guidance: C-SCRM controls are managed centrally at Level 1 through the CSCRM Strategy and Implementation Plan and at Level 1 and Level 2 through the C-SCRM Policy.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 133- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Supplemental C-SCRM Guidance: C-SCRM controls are managed centrally at Level 1 through the CSCRM Strategy and Implementation Plan and at Level 1 and Level 2 through the C-SCRM Policy.
57. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 136
Narrow public claim
NIST SP 800-161 can be used as a source of topics and activities to include in the security and privacy workforce program.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 136- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
NIST SP 800-161 can be used as a source of topics and activities to include in the security and privacy workforce program.
58. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 138
Narrow public claim
Based on the C-SCRM Strategy and Implementation Plan at Level 1, the enterprise should select and document common C- SCRM controls that should address the enterprise, program, and system-specific needs.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 138- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Based on the C-SCRM Strategy and Implementation Plan at Level 1, the enterprise should select and document common C- SCRM controls that should address the enterprise, program, and system-specific needs.
59. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 139
Narrow public claim
Supplemental C-SCRM Guidance: The continuous monitoring strategy and program should integrate CSCRM controls at Levels 1, 2, and 3 in accordance with the Supply Chain Risk Management Strategy.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 139- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Supplemental C-SCRM Guidance: The continuous monitoring strategy and program should integrate CSCRM controls at Levels 1, 2, and 3 in accordance with the Supply Chain Risk Management Strategy.
60. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 140
Narrow public claim
Level 1: Applicable roles include risk executive, CIO, CISO, contracting, logistics, delivery/receiving, acquisition security, and other functions that provide supporting supply chain activities.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 140- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Level 1: Applicable roles include risk executive, CIO, CISO, contracting, logistics, delivery/receiving, acquisition security, and other functions that provide supporting supply chain activities.
61. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 140
Narrow public claim
Level 2: Applicable roles include program executive and individuals (e.g., non-federal employees, including contractors) within the acquirer enterprise who are responsible for program success (e.g., Program Manager and other individuals).
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 140- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Level 2: Applicable roles include program executive and individuals (e.g., non-federal employees, including contractors) within the acquirer enterprise who are responsible for program success (e.g., Program Manager and other individuals).
62. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 143
Narrow public claim
The policy should include supply chainrelevant cybersecurity roles that are applicable to performing and coordinating risk assessments across the enterprise (see Section 2 for the listing and description of roles).
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 143- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The policy should include supply chainrelevant cybersecurity roles that are applicable to performing and coordinating risk assessments across the enterprise (see Section 2 for the listing and description of roles).
63. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 143
Narrow public claim
In addition to [FIPS 199] categorization, security categorization for C-SCRM should be based on the criticality analysis that is performed as part of the SDLC.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 143- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
In addition to [FIPS 199] categorization, security categorization for C-SCRM should be based on the criticality analysis that is performed as part of the SDLC.
64. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 150
Narrow public claim
Supplemental C-SCRM Guidance: Relationships with providers37 should meet the following supply chain security requirements: a.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 150- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Supplemental C-SCRM Guidance: Relationships with providers37 should meet the following supply chain security requirements: a.
65. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 152
Narrow public claim
Developer-provided training should include CSCRM material to ensure that 1) developers are aware of potential threats and vulnerabilities when developing, testing, and maintaining hardware and software, and 2) the individuals responsible for selecting system and network components incorporate C-SCRM when choosing such components.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 152- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Developer-provided training should include CSCRM material to ensure that 1) developers are aware of potential threats and vulnerabilities when developing, testing, and maintaining hardware and software, and 2) the individuals responsible for selecting system and network components incorporate C-SCRM when choosing such components.
66. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 165
Narrow public claim
Supplemental C-SCRM Guidance: C-SCRM policies are developed at Level 1 for the overall enterprise and at Level 2 for specific missions and functions.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 165- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Supplemental C-SCRM Guidance: C-SCRM policies are developed at Level 1 for the overall enterprise and at Level 2 for specific missions and functions.
67. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 165
Narrow public claim
C-SCRM plans are influenced by the enterprise’s other risk assessment activities and may inherit and tailor common control baselines defined at Level 1 and Level 2.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 165- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
C-SCRM plans are influenced by the enterprise’s other risk assessment activities and may inherit and tailor common control baselines defined at Level 1 and Level 2.
68. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 166
Narrow public claim
SBOMs should be produced using only NTIA-supported SBOM formats that can satisfy [NTIA SBOM] EO 14028 NTIA minimum SBOM elements.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 166- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
SBOMs should be produced using only NTIA-supported SBOM formats that can satisfy [NTIA SBOM] EO 14028 NTIA minimum SBOM elements.
69. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 166
Narrow public claim
Supplemental C-SCRM Guidance: Section 3 and SA controls provide additional guidance on acquisition strategies, tools, and methods.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 166- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Supplemental C-SCRM Guidance: Section 3 and SA controls provide additional guidance on acquisition strategies, tools, and methods.
70. NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices · PDF page 170
Narrow public claim
Given that C-SCRM is an enterprise-wide activity that requires the selection and implementation of controls at the enterprise, mission and business, and operational levels (Levels 1, 2, and 3 of the enterprise according to [NIST SP 800-39]), Table B-1 indicates the enterprise levels at which the controls should be implemented.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- Section locator
PDF page 170- Captured
- 2026-08-11
- Source SHA-256
c8250b1ea542640a7cffc145be08c6b17ff76bd695f8c0ac1b40c49d45355d89- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom011_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Given that C-SCRM is an enterprise-wide activity that requires the selection and implementation of controls at the enterprise, mission and business, and operational levels (Levels 1, 2, and 3 of the enterprise according to [NIST SP 800-39]), Table B-1 indicates the enterprise levels at which the controls should be implemented.