NIST Updates Guidance for Supply Chain Risk Management

The U.S. National Institute of Standards and Technology, on the back of U.S. President Joe Biden’s executive orders regarding cybersecurity, on Thursday revised its guidance for countering supply chain risks. The revised publication, titled “Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations,” provides guidance on identifying, assessing and responding to cybersecurity risks throughout the supply chain at all levels of an organization. It is part of NIST’s response to Executive Order 14028: Improving the Nation’s Cybersecurity – specifically, Sections 4(c) and (d), which focus on enhancing the security of the software supply chain. The revised document is the result of several years of development, which entailed two draft versions.