Skip to main content

🔔 Notifications Hub: See compliance updates in one place

Supply Chain Risk Management (SCRM)

Supply chain risk management is the work of identifying and mitigating risks introduced by your suppliers, their suppliers, and the components moving through the chain. For defense contractors, the specific form is C-SCRM (cyber supply chain risk management), defined in NIST SP 800-161 Rev 1. CMMC Level 2 includes SCRM practices. DFARS 252.204-7012 pushes cybersecurity requirements down the chain automatically.

SCRM vs C-SCRM

SCRM covers the full chain of risks: quality, geopolitical, counterfeit parts, single-source dependencies, financial health of suppliers. C-SCRM narrows this to cybersecurity risks. Both matter, but NIST 800-161 Rev 1 is specifically a C-SCRM document.

What NIST SP 800-161 Rev 1 Covers

  • Enterprise-level governance: who owns C-SCRM, how it integrates with risk management, where it sits relative to the NIST Risk Management Framework (SP 800-37).
  • Mission-level planning: identifying critical suppliers and critical components for each mission or product line.
  • Operational-level practices: supplier assessments, contract language, SBOM collection, incident response coordination, and counterfeit prevention.

Common Supply Chain Attack Patterns

  • Compromised updates: SolarWinds Orion (2020) pushed malicious updates to 18,000 customers.
  • Counterfeit parts: In 2016, the DoD reported 1,800 cases of suspect counterfeit electronic parts in F-15, F-16, and C-130 aircraft.
  • Dependency hijacks: Event-stream (2018), ua-parser-js (2021), and xz-utils (2024) all shipped malicious code through trusted open-source channels.

Flow-Down Is C-SCRM in Practice

DFARS 252.204-7012 requires primes to include the same clause in subcontracts where CUI is involved. This is the enforcement mechanism for C-SCRM across the Defense Industrial Base. A seventh-tier supplier who handles a technical drawing with a distribution statement has the same NIST 800-171 obligations as the prime, because that is what the flow-down says.

SBOMs and Component Tracking

A Software Bill of Materials lists every component in a piece of software, including transitive dependencies. CISA, the FDA, and OMB Memorandum M-22-18 have all pushed SBOMs for federal software procurement. For defense contractors, SBOMs make it tractable to respond when the next Log4j lands at 3 a.m.