Cybersecurity Supply Chain Risk Management (C-SCRM)

A self-paced treatment of cybersecurity supply chain risk management, following the structure of NIST SP 800-161r1. The route runs from foundations and threat sources through criticality analysis, folding C-SCRM into enterprise risk management, standing up the program, assessing suppliers, setting procurement requirements, applying controls, handling the software supply chain, and monitoring — finishing in an applied workshop. Criticality analysis comes before any supplier assessment, since treating every supplier as equally important burns the budget before you reach the ones that could halt operations. The three-level model keeps organization, mission and business process, and system-level C-SCRM distinct — a line practitioners often blur.

The material reflects the supply chain regulatory position as of August 2026, which has been rewritten repeatedly since early 2025: the secure-software attestation mandate, for instance, was rescinded in January 2026 and is now left to each organization to decide. The final module teaches you to establish for yourself whether a cited clause, prohibition or deadline is still in force. On software, the course goes past defining SBOM to SPDX and CycloneDX formats, VEX as the artifact that shows whether a vulnerability is genuinely exploitable, build-integrity levels, and artifact-signing and project-health tooling. The NIST core is vendor-neutral and applies directly to any third-party risk program, with procurement-specific content running as a marked thread.

What You Will Learn

• Define cybersecurity supply chain risk and distinguish it from traditional supply chain risk
• Identify supply chain threat sources, including counterfeit and compromised components, firmware tampering, and supplier compromise
• Perform criticality and dependency analysis, and identify single points of failure and concentration risk
• Separate organization-level, mission and business-process-level, and system-level C-SCRM, and escalate risk to the right decision-maker
• Build a C-SCRM strategy, policy set and system-level plan, and coordinate across security, acquisition, legal, procurement and operations
• Assess supplier criticality and cybersecurity practice using an evidence-based due-diligence structure
• Define security requirements before procurement, and write them into agreements including flow-down to subcontractors
• Apply the NIST SP 800-53 Supply Chain Risk Management control family, SR-1 through SR-12
• Evaluate software supply chain risk using SBOM, VEX, build-integrity levels and project-health tooling
• Assess AI and machine learning suppliers, including model and training-data provenance
• Treat cryptographic inventory and agility as a supplier due-diligence question
• Monitor supplier risk continuously, respond to supplier incidents, and manage risk through end-of-life and supplier transitions
• Verify whether a cited rule, clause or deadline is still current before relying on it

Course Outline

Module 1

• Know Your Chain: C-SCRM Foundations
• Defining C-SCRM
• Traditional versus cybersecurity supply chain risk
• Products, services, suppliers, developers, integrators and service providers
• First-party, third-party and downstream relationships
• Dependencies and inherited risk
• Why reduced visibility creates risk

Module 2

• Where Risk Enters: Supply Chain Threats and Vulnerabilities
• Threat sources
• Counterfeit, compromised and malicious components
• Software and firmware tampering
• Vulnerable or malicious third-party software
• Supplier and service-provider compromise
• Insider risk within the supply chain
• Supplier disruption and loss of availability

Module 3

• See What Matters: Criticality and Dependency Analysis
• Identifying critical systems, components, data and services
• Mission and business dependencies
• Critical suppliers
• Single points of failure
• Concentration and systemic risk
• Upstream and downstream dependencies
• Prioritizing resources by criticality

Module 4

• Three Levels, One Risk Picture: Integrating C-SCRM into Risk Management
• C-SCRM within enterprise risk management
• Organization, mission and business-process, and system levels
• Risk appetite and tolerance
• Roles across levels
• Escalation to decision-makers
• Connecting to the Risk Management Framework and to supply chain's place in the Govern function of Cybersecurity Framework 2.0

Module 5

• Build the Program: C-SCRM Strategy, Policy, and Planning
• Developing a strategy
• Policies and procedures
• Implementation planning
• System-level C-SCRM plans
• Governance and accountability
• Coordinating cybersecurity, acquisition, legal, procurement and operations
• Measuring and improving capability

Module 6

• Know Your Supplier: Supplier Risk Assessment
• Identifying and categorizing suppliers
• Determining criticality
• Evaluating supplier cybersecurity practice
• Assessing products and services before acquisition
• Sources of supplier risk information
• Evidence-based assessment across foreign ownership, control or influence, provenance, resilience, foundational cyber practices and supply chain tiers
• Risk scoring
• When additional assurance is required

Module 7

• Security Before the Signature: Acquisition and Supplier Requirements
• Integrating cybersecurity into acquisition
• Defining and communicating security requirements before procurement
• Requirements in agreements and contracts
• Flow-down to subcontractors
• Supplier notification and incident-reporting expectations
• Vulnerability disclosure and remediation
• Authenticity, provenance and integrity
• Acquisition strategies that reduce exposure

Module 8

• Trust but Verify: Supply Chain Controls and Assurance
• The SP 800-53 Supply Chain Risk Management control family
• SR-1 through SR-12
• Supply chain risk management plans
• Supplier assessments and reviews
• Tamper resistance and detection
• Component authenticity
• Supplier notification agreements
• Inspection of systems and components
• Component disposal
• Selecting controls by organizational risk

Module 9

• Software in the Chain: Software Supply Chain Risk
• Software as a dependency
• Commercial, open-source and internally developed software
• Third-party libraries
• Provenance and integrity
• SBOM formats including SPDX and CycloneDX
• VEX and exploitability context
• Build-integrity levels
• Project-health and artifact-signing tooling
• Patch integrity
• Risks in build and development environments

Module 10

• Stay Ahead of the Chain: Monitoring and Response
• Continuous monitoring of suppliers
• Tracking changes in supplier risk
• Vulnerability and threat intelligence
• Supplier security incidents
• Supply chain incident response
• Reassessment triggers
• Changes in ownership, products or services
• Risk acceptance, mitigation, transfer, avoidance and sharing
• Updating the risk register

Module 11

• From Supplier to Sunset: Lifecycle C-SCRM
• C-SCRM across the system development lifecycle
• Planning and acquisition
• Development and integration
• Operations and maintenance
• Supplier changes and replacement
• End-of-life and end-of-support risk
• Secure component disposal
• Data and credential protection during supplier transitions

Module 12

• Put It Together: C-SCRM Scenario Workshop
• Identify assets, suppliers and dependencies in a sample environment, determine which are most critical, build threat scenarios, assess likelihood and impact, evaluate supplier evidence, select risk responses and controls, draft supplier security requirements, document a risk register and justify a C-SCRM decision

Module 13

• The Ground Is Moving: Regulatory Currency and Emerging Domains
• AI and machine learning supply chain risk including model and training-data provenance, malicious models in public repositories, and vendor-disclosure obligations for procured AI
• Post-quantum cryptography as a supply chain domain, cryptographic inventory and agility as due-diligence questions, and the 2030 federal compliance deadline
• And how to verify whether a federal clause, prohibition or deadline is still in force

This course is available for 365 days. You can choose when to start your access period. Once you activate, you will have 365 days to complete it (access the course materials, quizzes, projects and videos). You may request one extension of seven (7) days. Other extension requests will be evaluated on a case-by-case basis. Videos are not downloadable.