[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Compliance and Regulations](/category/compliance-and-regulations) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [How to Meet Third-Party Risk Requirements of NIST 800-161](/blog/third-party-risk-requirements-nist-800-161) Publish date November 16, 2025 {x} minute read # How to Meet Third-Party Risk Requirements of NIST 800-161 [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/nist-compliance-guide) [Free trial](/demo) Written by [Edward Kost](/team/edward-kost) Senior Cybersecurity Writer Edward is a cyber writer with a mechanical engineering background. His work has been referenced by academic institutions and government bodies. Reviewed by [Tulin Sevgin](/team/tulin-sevgin) Director of Third-Party Risk Management Tulin's expertise in third-party risk management has been featured in cybersecurity podcasts, industry conferences, and specialized panel discussions. Table of contents eBook NIST Compliance Guide Free resource ### NIST Compliance Guide [Download now](/resources/nist-compliance-guide) The National Institute of Standards and Technology (NIST) has produced several publications addressing the different components of [information security](https://www.upguard.com/blog/information-security) within the NIST 800 computer security series. Compliance across this entire NIST 800 series is expected for all internal and external service providers of government entities - such as the DoD federal agencies. Though not obliged to comply, many private organizations use the NIST 800 series as a maturity model for achieving a minimal baseline of cybersecurity, especially in the area of [supply chain risk management (SCRM)](https://www.upguard.com/blog/what-is-supply-chain-risk-management). NIST has produced three special publications focused on mitigating [supply chain attacks](https://www.upguard.com/blog/supply-chain-attack): * [NIST SP 800-53](https://www.upguard.com/blog/nist-sp-800-53) Rev 5 * NIST SP 800-161 * [NIST Cybersecurity Framework (NIST CSF)](https://www.upguard.com/blog/nist-cybersecurity-framework) In October 2021, NIST SP 800-161 was revised. The second public draft, known as NIST 800-161 Revision 1, includes two new appendices: * **Appendix E** - Provides additional guidance to specific federal agencies related to FASCSA * **Appendix F** - Provides a response to the directives outlined in section 4(c) of[ Executive Order 14028](https://www.federalregister.gov/documents/2021/05/17/2021-10460/improving-the-nations-cybersecurity). *The second draft of the NIST SP 800-161 revision 1*[* can be accessed here*](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-161r1-draft2.pdf)*.* *The original NIST SP 800-161 publication can be*[* accessed here*](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-161.pdf)*.* This post will focus on the NIST 800-161 special publication and explain how its third-party risks mitigation metrics can be addressed. ## What’s the Difference Between NIST 800-53 and NIST 800-161? NIST 800-53 is the foundational framework for all security controls within the NIST 800 series. NIST 800-161 is considered a complementary addition to this foundation to further mature supply chain security programs. In other words, the NIST 800-53 framework is a prerequisite to the NIST 800-161 framework. Utilize this free [NIST 800-53 risk assessment template](https://www.upguard.com/templates/nist-800-53-risk-assessment) to evaluate your vendors' alignment with NIST 800-53 standards. Implementing both risk management frameworks in SCRM programs is recommended for all businesses in public and private sectors. This will establish the most comprehensive template for mitigating ICT supply chain risks in business processes. **Related: **[Meeting the Third-Party Risk Management Requirements of NIST 800-53.](https://www.upguard.com/blog/third-party-risk-requirements-nist-800-53) ## Is NIST 800-161 Compliance Mandatory? [Compliance with NIST’s special publications ](https://www.upguard.com/blog/nist-compliance)is mandatory for all U.S federal agencies. All other entities can choose whether they implement NIST frameworks in their [information security policies](https://www.upguard.com/blog/information-security-policy). However, all information and communication technology ecosystems can benefit from the risk management programs presented in special publication 800-161. [Use this checklsit to track compliance with NIST 800-161 >](https://www.upguard.com/blog/nist-800-161-compliance-checklist) ## NIST 800-161 ICT SCRM Control Family Summary NIST 800-161 outlines several ICT SCRM relevant controls across 18 different control families: 1. [Access Control](https://www.upguard.com/blog/access-control) 2. Awareness and training 3. Audit and Accountability 4. Security Assessment and Authorization 5. [Configuration Management](https://www.upguard.com/blog/5-configuration-management-boss) 6. Contingency Planning 7. Identification and Authentication 8. Incident Response 9. Maintenance 10. Media Protection 11. Physical and Environmental Protection 12. Planning 13. Program Management 14. Personnel Security 15. Risk Assessment 16. System and Services Acquisition 17. System and Communication Protection 18. System and Information Integrity. For a summary of all the ICT SCRM controls within each family, refer to page 126 of[ NIST SP 800-161](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-161.pdf). [Learn how to communicate third-party risk to the Board >](https://www.upguard.com/blog/how-to-communicate-third-party-risk-to-the-board) ## Meeting Third-Party Risk Mitigation Requirements in NIST SP 800-161 with UpGuard Because NIST 800-53 is a foundational framework for NIST SP 800-161, there’s an overlap between the security requirements of both frameworks. Even with the exclusion of this overlap, the remaining list of ICT SCRM control is lengthy, and it would be inefficient to map compliance efforts to each individual control. Instead, compliance is most efficiently achieved by following best cyber supply chain risk management practices. Some suggested supply chain risk management practices for federal information systems and organizations are outlined below: * Continuous monitoring of cybersecurity risks in the supply chain - Real-time tracking of attack surface exploits empowers organizations to address supply chain security risks before cybercriminals exploit them.\ \ *UpGuard scans the entire third-party attack surface for security vulnerabilities that could facilitate supply chain attacks.*[* Click here*](https://www.upguard.com/product/vendorrisk)* to learn more.* - Third-party risk remediation validation - Security ratings confirm vendors follow through with requested risk management processes. Security ratings also ensure service providers meet their contractual obligations to safeguard critical information.\ \ *UpGuard assigns each third-party vendor a security rating based on over 70 attack vectors.*[* Click here*](https://www.upguard.com/blog/what-are-security-ratings)* to learn more about security ratings.\ ‍* - Security questionnaire automation - Automate supply chain risk assessments mapping to regulatory and industry standards, such as [ISO/IEC 27001](https://www.upguard.com/blog/what-is-iso-27001), [NIST](https://www.upguard.com/compliance/nist-cybersecurity-framework), [COBIT](#), and ISA.\ \ UpGuard offers an extensive library of security questionnaires, mapping to popular cybersecurity frameworks and standards. The following list of questionnaires are available on the UpGuard platform: 1. CyberRisk Questionnaire 2. ISO 27001 Questionnaire 3. Short Form Questionnaire 4. NIST Cybersecurity Framework Questionnaire 5. PCI DSS Questionnaire: 6. [California Consumer Privacy Act (CCPA)](https://www.upguard.com/blog/what-is-the-ccpa) Questionnaire 7. Modern Slavery Questionnaire 8. Pandemic Questionnaire 9. Security and Privacy Program Questionnaire 10. Web Application Security Questionnaire: 11. Infrastructure Security Questionnaire 12. Physical and Data Centre Security Questionnaire 13. COBIT 5 Security Standard Questionnaire 14. ISA 62443-2-1:2009 Security Standard Questionnaire 15. ISA 62443-3-3:2013 Security Standard Questionnaire 16. [GDPR](https://www.upguard.com/blog/how-to-be-gdpr-compliant) Security Standard Questionnaire 17. [CIS Controls](https://www.upguard.com/blog/cis-controls) 7.1 Security Standard Questionnaire 18. NIST SP 800-53 Rev. 4 Security Standard Questionnaire 19. SolarWinds Questionnaire 20. Kaseya Questionnaire [See UpGuard’s questionnaire library in a live demo >](https://www.upguard.com/demo) * **Implement a Third-Party Risk Management Program (TPRM**) - A TPRM will address the complete domain of third-party risk mitigation, including third-party assessments and regulatory requirements tracking. Outsourcing this effort to a TPRM service provider is becoming an increasingly popular decision amongst stakeholders seeking a scalable TPRM model.**‍** * **Rank third-party vendors by risk criticality** - Prioritizing vendors with the most significant potential impact on security postures could significantly reduce the success rates of supply chain [cyberattacks](https://www.upguard.com/blog/cyber-attack).\ \ *UpGuard offers a *[*Vendor Tiering*](https://www.upguard.com/blog/what-is-vendor-tiering)* feature to help you rank vendors based on their potential degree of impact on security postures.*[**\ ‍](https://www.upguard.com/blog/what-is-vendor-tiering) - **Regularly update and test response plans** - Response plans should be regularly exercised with unexpected penetration testing.\ \ [Learn more about incident response planning.](https://www.upguard.com/blog/incident-response-plan)\ *‍* - **Broaden the scope of vendor security information sharing** - For the most accurate evaluation of an organization’s risk profile, risk assessments should be customizable. This will accommodate for the unique supply chain security objectives of critical infrastructures and privacy controls.\ \ *With UpGuard’s customer questionnaire builder, you can create questionnaires by either modifying existing assessments or building upon a blank canvas. *[*Learn more about UpGuard’s custom questionnaire builder*](https://www.upguard.com/blog/overview-custom-questionnaire-builder)*.\ ‍* - **Detect and shut down third-party data leaks **- Data leaks help cybercriminals gain unauthorized access to vendors in the supply chain.\ *UpGuard’s proprietary data leak detection engine discovers overlooked exposures across common hosts of data leak dumps, including dark web forums.*[* Click here*](https://www.upguard.com/blog/data-leak)* to learn more about data leaks.* - *‍***Secure the vendor onboarding process** - The vendor procurement process significantly impacts security posture. As a result, the risk profiles of prospective vendors should be heavily scrutinized - an effort that should continue throughout the entire lifecycle of all vendors. [Learn how OVO secured its vendor onboarding process with UpGuard >](https://www.upguard.com/customers/ovo) eBook NIST Compliance Guide Free resource ### NIST Compliance Guide [Download now](/resources/nist-compliance-guide) ## Related posts Learn more about the latest issues in cybersecurity. Compliance and Regulations #### [Cyber Resilience Act Preparedness: Who's Ready, and Who Can't Be Reached](/blog/cyber-resilience-act-preparedness-whos-ready-and-who-cant-be-reached) We surveyed 2,374 EU-registered devices and 226 listed software makers for a way to report a vulnerability. Market leaders are ready. Others, not so much. [](/team/greg-pollock) [Greg Pollock](#) October 13, 2026 Human Cyber Risk #### [AI Assurance: The Third Head of Your AI Governance Watchdog](/blog/ai-governance-to-ai-assurance) AI governance needs three things: policy, enforcement, and assurance. Most organizations have built the first two. Here's why the third one matters now. [](/team/shane-moosa) [Shane Moosa](#) September 21, 2026 Compliance and Regulations #### [NIST compliance in 2026: A complete implementation guide](/blog/nist-compliance) NIST compliance ensures alignment with leading cybersecurity frameworks. Explore how the NIST standards can safeguard sensitive data and manage third-party [](/team/edward-kost) [Edward Kost](#) January 5, 2026 Compliance and Regulations #### [Introducing UpGuard’s DPDP Act Security Questionnaire](/blog/upguards-dpdp-security-questionnaire) Discover the latest addition to UpGuard's industry-leading Questionnaire Library and learn how to achieve comprehensive DPDP compliance. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) November 19, 2024 Compliance and Regulations #### [From NIS to NIS2: What Your Organization Needs to Know](/blog/nis-vs-nis2) Understanding the transition from NIS to NIS2 is crucial for protecting your organization. Explore the key changes and compliance steps in this blog. [](/team/leah-sadoian) [Leah Sadoian](#) July 4, 2025 Compliance and Regulations #### [How to Prepare for a Cyber Essentials Plus Audit](/blog/prepare-for-a-cyber-essentials-plus-audit) Learn more about the Cyber Essentials Plus independent assessment process, and steps your organization can take to prepare. [](/team/leah-sadoian) [Leah Sadoian](#) July 3, 2025 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)