Cybersecurity Supply Chain Risk Management (C-SCRM)

A practitioner course in cybersecurity supply chain risk management, structured on NIST SP 800-161r1: foundations and threats, criticality analysis, integration with enterprise risk management, program building, supplier assessment, procurement requirements, controls, software supply chain, monitoring, and the full supplier lifecycle, closing in an applied workshop. Criticality is taught early, ahead of any supplier assessment, because assessing every supplier equally exhausts the budget before reaching the ones that could halt operations. The three-level model — organization, mission and business process, and system — separates layers practitioners often collapse together.

The course is built to the supply chain regulatory baseline as of August 2026, which has been rewritten repeatedly since early 2025 — the secure-software attestation mandate, for example, was rescinded in January 2026 and is now optional. The closing module teaches participants to verify for themselves whether a cited clause, prohibition or deadline remains in force. On software, the material goes past naming SBOM to SPDX and CycloneDX, VEX as the artifact that shows whether a listed vulnerability is exploitable, build-integrity levels, and artifact-signing and project-health tooling. The NIST core is vendor-neutral and transfers directly to any third-party risk program, with procurement-specific content kept as a marked thread.

What You Will Learn

• Define cybersecurity supply chain risk and distinguish it from traditional supply chain risk
• Identify supply chain threat sources, including counterfeit and compromised components, firmware tampering, and supplier compromise
• Perform criticality and dependency analysis, and identify single points of failure and concentration risk
• Separate organization-level, mission and business-process-level, and system-level C-SCRM, and escalate risk to the right decision-maker
• Build a C-SCRM strategy, policy set and system-level plan, and coordinate across security, acquisition, legal, procurement and operations
• Assess supplier criticality and cybersecurity practice using an evidence-based due-diligence structure
• Define security requirements before procurement, and write them into agreements including flow-down to subcontractors
• Apply the NIST SP 800-53 Supply Chain Risk Management control family, SR-1 through SR-12
• Evaluate software supply chain risk using SBOM, VEX, build-integrity levels and project-health tooling
• Assess AI and machine learning suppliers, including model and training-data provenance
• Treat cryptographic inventory and agility as a supplier due-diligence question
• Monitor supplier risk continuously, respond to supplier incidents, and manage risk through end-of-life and supplier transitions
• Verify whether a cited rule, clause or deadline is still current before relying on it

Course Outline

Module 1

• Know Your Chain: C-SCRM Foundations
• Defining C-SCRM
• Traditional versus cybersecurity supply chain risk
• Products, services, suppliers, developers, integrators and service providers
• First-party, third-party and downstream relationships
• Dependencies and inherited risk
• Why reduced visibility creates risk

Module 2

• Where Risk Enters: Supply Chain Threats and Vulnerabilities
• Threat sources
• Counterfeit, compromised and malicious components
• Software and firmware tampering
• Vulnerable or malicious third-party software
• Supplier and service-provider compromise
• Insider risk within the supply chain
• Supplier disruption and loss of availability

Module 3

• See What Matters: Criticality and Dependency Analysis
• Identifying critical systems, components, data and services
• Mission and business dependencies
• Critical suppliers
• Single points of failure
• Concentration and systemic risk
• Upstream and downstream dependencies
• Prioritizing resources by criticality

Module 4

• Three Levels, One Risk Picture: Integrating C-SCRM into Risk Management
• C-SCRM within enterprise risk management
• Organization, mission and business-process, and system levels
• Risk appetite and tolerance
• Roles across levels
• Escalation to decision-makers
• Connecting to the Risk Management Framework and to supply chain's place in the Govern function of Cybersecurity Framework 2.0

Module 5

• Build the Program: C-SCRM Strategy, Policy, and Planning
• Developing a strategy
• Policies and procedures
• Implementation planning
• System-level C-SCRM plans
• Governance and accountability
• Coordinating cybersecurity, acquisition, legal, procurement and operations
• Measuring and improving capability

Module 6

• Know Your Supplier: Supplier Risk Assessment
• Identifying and categorizing suppliers
• Determining criticality
• Evaluating supplier cybersecurity practice
• Assessing products and services before acquisition
• Sources of supplier risk information
• Evidence-based assessment across foreign ownership, control or influence, provenance, resilience, foundational cyber practices and supply chain tiers
• Risk scoring
• When additional assurance is required

Module 7

• Security Before the Signature: Acquisition and Supplier Requirements
• Integrating cybersecurity into acquisition
• Defining and communicating security requirements before procurement
• Requirements in agreements and contracts
• Flow-down to subcontractors
• Supplier notification and incident-reporting expectations
• Vulnerability disclosure and remediation
• Authenticity, provenance and integrity
• Acquisition strategies that reduce exposure

Module 8

• Trust but Verify: Supply Chain Controls and Assurance
• The SP 800-53 Supply Chain Risk Management control family
• SR-1 through SR-12
• Supply chain risk management plans
• Supplier assessments and reviews
• Tamper resistance and detection
• Component authenticity
• Supplier notification agreements
• Inspection of systems and components
• Component disposal
• Selecting controls by organizational risk

Module 9

• Software in the Chain: Software Supply Chain Risk
• Software as a dependency
• Commercial, open-source and internally developed software
• Third-party libraries
• Provenance and integrity
• SBOM formats including SPDX and CycloneDX
• VEX and exploitability context
• Build-integrity levels
• Project-health and artifact-signing tooling
• Patch integrity
• Risks in build and development environments

Module 10

• Stay Ahead of the Chain: Monitoring and Response
• Continuous monitoring of suppliers
• Tracking changes in supplier risk
• Vulnerability and threat intelligence
• Supplier security incidents
• Supply chain incident response
• Reassessment triggers
• Changes in ownership, products or services
• Risk acceptance, mitigation, transfer, avoidance and sharing
• Updating the risk register

Module 11

• From Supplier to Sunset: Lifecycle C-SCRM
• C-SCRM across the system development lifecycle
• Planning and acquisition
• Development and integration
• Operations and maintenance
• Supplier changes and replacement
• End-of-life and end-of-support risk
• Secure component disposal
• Data and credential protection during supplier transitions

Module 12

• Put It Together: C-SCRM Scenario Workshop
• Identify assets, suppliers and dependencies in a sample environment, determine which are most critical, build threat scenarios, assess likelihood and impact, evaluate supplier evidence, select risk responses and controls, draft supplier security requirements, document a risk register and justify a C-SCRM decision

Module 13

• The Ground Is Moving: Regulatory Currency and Emerging Domains
• AI and machine learning supply chain risk including model and training-data provenance, malicious models in public repositories, and vendor-disclosure obligations for procured AI
• Post-quantum cryptography as a supply chain domain, cryptographic inventory and agility as due-diligence questions, and the 2030 federal compliance deadline
• And how to verify whether a federal clause, prohibition or deadline is still in force