An international standard for security and resilience management systems, focused on managing security-related risks in supply chains and integrating with other ISO management system standards.

NIST C-SCRM (SP 800-161 Rev. 1)

U.S. guidance on Cybersecurity Supply Chain Risk Management that outlines practices for managing cyber risks from suppliers across the system lifecycle.

An EU cybersecurity directive that expands obligations to more sectors and explicitly requires organizations to address supply chain security and incident reporting.

EU Cyber Resilience Act

EU regulation setting cybersecurity requirements for products with digital elements, including lifecycle vulnerability management and attention to supply chain components.

Corporate Sustainability Due Diligence Directive (CSDDD)

EU directive requiring large companies to conduct human-rights and environmental due diligence across their operations and value chains, integrating it into risk management.

NIST Cybersecurity Supply Chain Risk Management guidance, especially NIST SP 800-161 Rev. 1, detailing practices to manage cyber risks from suppliers.

What is Due Diligence?

Ongoing process by which a company identifies, prevents, mitigates, and accounts for adverse impacts linked to its activities and business relationships.

What is NIS2 Directive?

EU cybersecurity directive that broadens the scope of regulated entities and requires risk management and incident reporting, including supply chain security.

Regulations and Standards Shaping Supply Chain Risk — Supply Chain Risk Management: From Vulnerabilities to Resilience

1. Why Regulations Now Drive Supply Chain Risk Management

From Best Practice to Legal Duty

Supply chain risk management is shifting from a voluntary best practice to a legal and contractual expectation driven by governments and standard-setters worldwide.

Three Things Regulations Do

Regulations force transparency about suppliers, impose active duties to prevent and mitigate risk, and create real consequences like fines, market exclusion, and reputational damage.

Three Big Clusters

We will focus on: security and resilience standards, digital/ICT supply chain rules, and sustainability & human-rights due diligence across global supply networks.

Your Perspective

Think like a supply chain manager: for each law or standard, ask how it would change supplier selection, contract clauses, monitoring, and crisis preparedness.

2. Global Regulatory Trends: The Big Picture

Why Rules Tightened

Since about 2020, geopolitical tensions, pandemics, and cyberattacks have exposed how fragile and concentrated many supply chains are.

Cyber & ICT Risks

Incidents like SolarWinds showed that suppliers, especially software and IT providers, can be powerful attack vectors into many organizations.

Sustainability & Rights

Climate, deforestation, and forced labor scandals pushed regulators from voluntary CSR toward mandatory environmental and human-rights due diligence.

Direction of Travel

Regulation is moving toward mandatory due diligence, explicit supply chain controls, and multi-tier transparency, not just Tier-1 supplier checks.

3. ISO 28000:2022 – Security and Resilience Management Systems

What Is ISO 28000:2022?

ISO 28000:2022 defines requirements for a security management system focused on supply chain security and resilience, replacing older versions of ISO 28000.

Scope and Purpose

It helps organizations identify, assess, and treat security-related risks affecting supply chains, from theft and fraud to cyber-physical threats.

Core Elements

Key elements: understand context and stakeholders, show leadership, plan via risk assessment, operate and support controls, then evaluate and improve.

Why It Matters

ISO 28000:2022 offers a structured, auditable framework that customers can require in contracts and that integrates with ISO 27001 and ISO 22301.

4. Applying ISO 28000:2022 – A Practical Scenario

Meet ElectraTech

ElectraTech, a mid-sized electronics maker, must prove to a major customer that its supply chain is secure and resilient using ISO 28000:2022.

Scoping & Risks

They scope inbound components, warehousing, and logistics, then assess risks like cargo theft, counterfeit parts, insider theft, and ransomware.

Controls in Practice

ElectraTech adds tamper-evident seals, vetted carriers, GPS tracking, dual checks for incoming goods, and tighter access controls on logistics IT.

Different Partner Types

Large 3PLs face audit and ISO 28000-based requirements, while small logistics firms receive simplified guidelines and training instead of full certification.

5. Cybersecurity Supply Chain Risk: NIST C-SCRM and Related Guidance

What Is C-SCRM?

Cybersecurity Supply Chain Risk Management focuses on risks from relying on external suppliers for software, hardware, and digital services.

Key NIST Documents

NIST SP 800-161 Rev. 1 and related C-SCRM implementation guides provide detailed practices, especially relevant for U.S. federal-related work.

Core Emphases

NIST stresses a lifecycle view, integration with enterprise risk management, and attention to multi-tier dependencies, including open-source components.

Impact on Suppliers

C-SCRM shapes how organizations choose suppliers, write security clauses into contracts, and continuously monitor software, SBOMs, and incidents.

6. Thought Exercise: Applying NIST C-SCRM to a Cloud Supplier

You are the supply chain risk analyst for a healthcare startup that wants to use a new cloud-based analytics platform to process sensitive patient data.

Using NIST C-SCRM principles, think through the following prompts. You can jot down bullet-point answers.

Supplier selection

What 3–4 security-related questions would you ask the cloud supplier before shortlisting them?
Example dimensions: data location, incident history, certifications (e.g., SOC 2, ISO 27001), secure development practices.

Contract clauses

List 3 specific cybersecurity supply chain clauses you would want in the contract.
Think about: breach notification timelines, right to audit or receive independent audit reports, requirements for subcontractors.

Monitoring and exit

How would you monitor this supplier over time? Mention at least 2 mechanisms (e.g., annual reports, vulnerability feeds, penetration test summaries).
What exit or transition arrangements would you want in place in case the supplier suffers a major incident or is acquired by a risky entity?

Multi-tier awareness

How could you gain visibility into the supplier's own dependencies (e.g., use of third-party libraries, sub-processors)?
How might SBOMs or sub-processor lists help you here?

After you answer, compare your ideas to the NIST C-SCRM themes: lifecycle management, contracts as control mechanisms, continuous monitoring, and multi-tier transparency.

7. EU and U.S. Regulatory Drivers: Resilience, ICT, and Crisis Preparedness

EU NIS2 & CRA

NIS2 expands cybersecurity duties and explicitly mentions supply chain security; the Cyber Resilience Act sets lifecycle security duties for digital products and their components.

EU Crisis Tools

The Single Market Emergency Instrument, Chips Act, and Critical Raw Materials Act push monitoring, diversification, and crisis coordination for key supply chains.

U.S. Drivers

U.S. Executive Orders, CISA guidance, and sector rules for healthcare, energy, and finance embed supply chain risk and resilience into federal expectations.

Link to Earlier Modules

These instruments force organizations to manage supplier risk, multi-tier dependencies, and resilience planning as core strategic issues, not side projects.

8. Sustainability and Human-Rights Due Diligence in Supply Chains

CSDDD & National Laws

The EU CSDDD and national laws in Germany, France, and others require large companies to manage human-rights and environmental risks across value chains.

Deforestation-free Supply Chains

The EU Deforestation-free Products Regulation forces traceability for commodities like soy, beef, palm oil, and cocoa down to the plot of land.

Packaging Rules

Updated EU packaging rules push for less waste, more recyclability, and recycled content, reshaping packaging materials and supplier choices.

Risk Implications

Non-compliance can trigger fines, product bans, reputational damage, and sudden supplier changes, making sustainability a core supply chain concern.

9. Quick Check: Regulatory Drivers and Standards

Test your understanding of how regulations and standards shape supply chain risk management.

Which statement best captures how modern regulations and standards affect supply chain management?

They mainly encourage voluntary reporting on environmental issues, with little impact on supplier selection or contracts.
They require organizations to integrate security, sustainability, and human-rights due diligence into supplier selection, contracting, and ongoing monitoring.
They only apply to government agencies and have limited relevance for private companies operating globally.

Show Answer

Answer: B) They require organizations to integrate security, sustainability, and human-rights due diligence into supplier selection, contracting, and ongoing monitoring.

Modern regulations (e.g., NIS2, CSDDD, deforestation rules) and standards (ISO 28000, NIST C-SCRM) push organizations to embed security, sustainability, and human-rights controls into how they choose, contract with, and monitor suppliers. It goes far beyond voluntary reporting or public-sector-only rules.

10. Flashcards: Key Terms and Instruments

Use these flashcards to review the most important concepts from this module.

ISO 28000:2022: An international standard for security and resilience management systems, focused on managing security-related risks in supply chains and integrating with other ISO management system standards.
NIST C-SCRM (SP 800-161 Rev. 1): U.S. guidance on Cybersecurity Supply Chain Risk Management that outlines practices for managing cyber risks from suppliers across the system lifecycle.
NIS2 Directive: An EU cybersecurity directive that expands obligations to more sectors and explicitly requires organizations to address supply chain security and incident reporting.
EU Cyber Resilience Act: EU regulation setting cybersecurity requirements for products with digital elements, including lifecycle vulnerability management and attention to supply chain components.
Corporate Sustainability Due Diligence Directive (CSDDD): EU directive requiring large companies to conduct human-rights and environmental due diligence across their operations and value chains, integrating it into risk management.
Deforestation-free Products Regulation (EU): EU regulation that requires certain commodities and products to be proven deforestation-free and legally produced, with traceability back to the plot of land.
Supply Chain Due Diligence: A continuous process of identifying, preventing, mitigating, and accounting for actual and potential adverse impacts in a company’s operations and supply chains.
Cybersecurity Supply Chain Risk: The risk that vulnerabilities or compromises in suppliers’ products, services, or processes will negatively affect an organization’s information systems and operations.

Key Terms

NIST C-SCRM: NIST Cybersecurity Supply Chain Risk Management guidance, especially NIST SP 800-161 Rev. 1, detailing practices to manage cyber risks from suppliers.
Due Diligence: Ongoing process by which a company identifies, prevents, mitigates, and accounts for adverse impacts linked to its activities and business relationships.
ISO 28000:2022: International standard for security and resilience management systems, with a focus on supply chain security risks.
NIS2 Directive: EU cybersecurity directive that broadens the scope of regulated entities and requires risk management and incident reporting, including supply chain security.
Critical Raw Materials: Raw materials considered economically and strategically important but at high risk of supply disruption, targeted by policies like the EU Critical Raw Materials Act.
EU Cyber Resilience Act: EU regulation imposing cybersecurity requirements on products with digital elements throughout their lifecycle, including supply chain considerations.
Supply Chain Resilience: The ability of a supply chain to prepare for, respond to, and recover from disruptions while maintaining critical operations.
SBOM (Software Bill of Materials): A formal, machine-readable list of components in a piece of software, used to improve visibility into software supply chain dependencies.
Deforestation-free Products Regulation: EU regulation requiring certain commodities and products to be deforestation-free and legally produced, supported by traceability.
Corporate Sustainability Due Diligence Directive (CSDDD): EU directive obliging large companies to conduct human-rights and environmental due diligence in their operations and value chains.