thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Intermediate

Cybersecurity Supply Chain Risk Management (C-SCRM)

Practices to identify, assess, and mitigate cybersecurity risks throughout the supply chain of products and services.

Definition

NIST SP 800-161 Rev. 1 provides C-SCRM guidance for organizations and is integrated with SP 800-53's SR family and CSF 2.0's GV.SC category. Activities include supplier criticality analysis, provenance, software bills of materials, secure development attestations, and contractual requirements. Incidents such as SolarWinds highlighted its importance.

Example

An agency requires suppliers to provide SBOMs and secure software development attestations.

Exam tip

In CSF 2.0, supply chain risk management sits under Govern (GV.SC).

Related terms