Third-Party Risk Management Program for CISOs: NIST SP 800-161, SEC Supply-Chain Disclosures and a Tiered Plan

TL;DR: A third-party risk management (TPRM) program is the set of processes an organization uses to find, assess and reduce risk from suppliers, service providers, software vendors and contractors. The National Institute of Standards and Technology (NIST) publication SP 800-161 is a voluntary reference for private companies. The Securities and Exchange Commission (SEC) rule requires public companies to describe how they assess, identify and manage material cybersecurity risks. This guide adds a vendor tiering model and a first-year plan.

What is a third-party risk management program?

A third-party risk management (TPRM) program is the set of processes an organization uses to find, assess and reduce the risk that comes from outside parties: suppliers, service providers, software vendors, contractors and the vendors behind them. In plain terms, it answers three questions. Who has access to our data or systems, what could go wrong with each of them, and what are we doing about it.

Three labels cover overlapping ground.

• Third-party risk management is the umbrella. It covers security, financial, operational and compliance risk from any outside relationship.
• Vendor risk management is the narrower, procurement-led version. It usually starts at contract signing and focuses on suppliers the company pays.
• Cybersecurity supply chain risk management (C-SCRM) is the term the National Institute of Standards and Technology (NIST) uses. Its guidance covers identifying, assessing, and mitigating cybersecurity risks throughout the supply chain at all levels of an organization.

NIST frames the problem around products and services that may potentially contain malicious functionality, are counterfeit, or are vulnerable because of poor development practices. In our reading, that scope reaches further than a typical vendor questionnaire. It pulls in hardware, open-source components and the build process, not just the vendor's policies.

The disclosure side comes from the Securities and Exchange Commission (SEC). Its final rule requires periodic disclosure about a registrant's processes to assess, identify and manage material cybersecurity risks, along with management's role and the board of directors' oversight. We think that turns third-party risk from an internal control into something a CISO may have to describe in a public filing. Our SEC disclosure guide covers the filing mechanics, and board cybersecurity oversight covers the governance angle.

Key facts

Two checks are worth doing now. First, confirm that internal policies cite SP 800-161r1-upd1 rather than the withdrawn 2022 revision. NIST lists the update page as updated January 6, 2025, so the citation in a policy should match the current record. Second, the effective date and the compliance dates are different things. The rule points readers to Section II.I (Compliance Dates) for the dates that apply to each filer, so counsel should confirm which ones apply to your company. Terms used here are defined in the glossary.

What does NIST SP 800-161 require?

The publication has gone through three editions, and the titles show how its scope widened. The original, dated SP 800-161 (04/08/2015), was titled Supply Chain Risk Management Practices for Federal Information Systems and Organizations. Its abstract opened with federal agencies' concern about information and communications technology (ICT) products and services.

The errata update covered earlier carries the report number 800-161r1-upd1 and keeps the Rev. 1 title.

Federal by design

The authority section ties the document to the Federal Information Security Modernization Act (FISMA) of 2014. Under that law, NIST sets minimum requirements for federal information systems, and the guideline is stated to be consistent with Office of Management and Budget (OMB) requirements. NIST's page also files Rev. 1 under Executive Order 14028.

Voluntary use by private companies was covered earlier. In our reading, a company that adopts the publication is choosing a reference point for its program. It is not meeting an obligation the document places on it.

What it sets out

The 2015 edition took a multitiered approach built around supply chain risk assessment and mitigation. Rev. 1 applies a multilevel approach specific to cybersecurity supply chain risk management (C-SCRM), and it runs to 326 pages.

In our reading, the length is the first obstacle for a private company. The 2015 edition mapped its guidance to control families that included Risk Assessment, System and Services Acquisition and System and Information Integrity. In our reading, those three cover most of what a third-party program touches: how vendors are assessed, what the purchase contract requires, and whether delivered products and updates can be trusted.

A practical reading order:

• Start with Appendix K of the update to see what the errata changed from Rev. 1.
• Read the acquisition guidance next and compare it with your standard vendor contract.
• Check whether your vendor intake questionnaire covers product integrity as well as data handling.
• Note the controls you skip and record why. An auditor or board member will ask, and a written rationale is easier to defend than a silent gap.

For terms used here, see the glossary.

What the SEC rule asks public companies to say about third parties

Regulation S-K Item 106 is the rule a reader opens to see what a public company must say about cybersecurity risk management. That includes risk from vendors and service providers. This section points to where the text sits and what a reader can check in a filing. It does not say how the rule applies to any one company.

Where the rule text lives

The amendments also reach Form 10-K, Form 8-K, Form 20-F and Form 6-K.

The release's own discussion of that part starts under the heading Risk Management and Strategy, with the final amendments on page 60. Compliance dates are not in the summary. The release says see Section II.I (Compliance Dates). Read that section for the dates that apply to annual reports, current reports and smaller reporting companies, rather than relying on a secondary summary.

Why the third-party language matters

In our reading, before the rule, third-party exposure surfaced only through general obligations. The earlier staff guidance said that "material information regarding cybersecurity risks and cyber incidents is required to be disclosed when necessary in order to make other required disclosures, in light of the circumstances under which they are made, not misleading." It pointed to the risk factor item, since moved to 17 CFR 229.105. In our reading, Item 106 moves vendor risk out of scattered risk factors and into a description of process.

What a reader can check in a filing

Read the rule text and the filing side by side. In our reading, if the filing answers each element in plain terms, that is a signal of disclosure discipline. If it only lists frameworks, it is not. For the full rule set, see the SEC disclosure guide and the glossary entry on Regulation S-K Item 106.

Board-level reporting on vendor risk is covered under board cybersecurity oversight.

What do 10-K filings say about third-party risk?

Three Item 1C filings show how differently companies describe the same exposure. Read them for wording. Each is a public record of what management was willing to say about its vendors.

Universal Logistics: reliance stated, framework hedged

Universal Logistics Holdings ties its operations to outside systems. Its filing says its operations "depend on a combination of proprietary and third-party systems, including transportation management, warehouse management, dispatch, billing, and customer-facing platforms" (Form 10-K).

The company also treats that dependency as residual risk. It cites "our reliance on third-party service providers" among the reasons it faces risks "that may not be fully preventable" (Form 10-K).

The framework language is careful. The program is "informed by, but does not purport to fully comply with" the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) (Form 10-K). In our reading, that phrasing limits what an investor can infer about control coverage, including coverage of vendors.

One Stop Systems: third parties as a named risk

One Stop Systems lists specific cyber risks inside Item 1C. One of them reads: "Third-Party Relationships: Our reliance on third-party vendors and service providers exposes us to additional cybersecurity risks, and a security breach affecting these entities could impact our operations" (Form 10-K).

The same filing describes some vendor work as planned. Management and the board say they intend to implement further measures, including "third-party vendor assessments" (Form 10-K).

Definitive Healthcare: hosted services and a virtual CISO

Definitive Healthcare puts "third party hosted services" inside the scope of its security processes (Form 10-K). Its information security function draws on outside providers, "including our virtual Chief Information Security Officer (“vCISO”)" (Form 10-K). Our glossary entry on the vCISO model explains the arrangement.

The filing spells out its vendor program: security questionnaires, risk assessments for each vendor, review of certain vendors' security programs, contractual obligations and, in some cases, calls with vendors' security staff (Form 10-K). It adds that the process may involve different levels of assessment depending on the provider (Form 10-K).

We think the useful habit is to read your own draft against filings like these. Say what you rely on, say what you have built, and say what is still planned. More Item 1C text is collected on our disclosures page.

How NIST SP 800-161, the SEC rule and 10-K practice compare

The three sources answer different questions. NIST SP 800-161, from the National Institute of Standards and Technology (NIST), tells an organization how to run cybersecurity supply chain risk management. The Securities and Exchange Commission (SEC) rule tells a public company what it must say about its risk processes. A Form 10-K shows what one company chose to say. The table sets them side by side, using Universal Logistics as the filing example.

In our reading, the gap that matters is between the middle column and the left one. The SEC asks a company to describe its processes. It does not ask the company to adopt NIST's practices. In our reading, a filing can be complete under the rule and still say little about vendor controls.

In our reading, Universal's disclaimer shows how filers handle that gap. Naming a framework as a reference point is not a claim of meeting it. When you read peer filings on /disclosures, read the framework sentence and the disclaimer together.

Some practical checks for your own program:

• Map your vendor tiers to the NIST practices you actually run. Do not map them to the framework as a whole.
• Confirm that what you say about third parties in Item 1C matches what your contracts and assessments can show.
• Note the 2024 update date in your policy. Then check Appendix K when you next review your supplier controls.

How are vendors tiered and assessed?

The tiering model below is our own view. It is not a NIST scheme. It starts from one line in the National Institute of Standards and Technology (NIST) publication: supply-chain risks are tied to an enterprise's decreased visibility into how acquired technology is developed, integrated and deployed. In our reading, a tier is a statement of how much of that visibility you need from a vendor, and how much you are willing to pay to get it.

The publication may be used by nongovernmental organizations on a voluntary basis. Private companies can adopt the model as they see fit. Its guidance covers risk assessments for products and services, which is the layer this section addresses.

Three questions set the tier

Ask each question of every vendor at intake, and again at renewal:

• Data access: what regulated, customer or confidential data the vendor stores, processes or can see.
• System access: whether the vendor holds credentials, network paths or code that runs inside your environment.
• Operational dependency: how long you could keep running if the vendor stopped tomorrow.

Take the highest answer, not the average. A payroll processor with no network access still holds sensitive data on every employee, so it belongs at the top. A facilities contractor with a badge reader on your network also moves up, even though it touches no data.

What each kind of evidence proves

A questionnaire tells you what the vendor says it does. An independent attestation tells you what a third party tested over a defined period. A contract clause gives you a remedy, and ongoing monitoring tells you whether anything has changed since you signed. None of these replaces the others. We think the common mistake is to collect all four for every vendor, which spreads reviewers so thin that the top tier gets no deeper look than the bottom.

The NIST abstract names products that may contain malicious functionality, are counterfeit, or are vulnerable due to poor manufacturing and development practices. In our reading, questionnaires rarely surface these risks. For software and hardware in the critical tier, add questions on build integrity and component sourcing.

What happens when a vendor is breached?

A vendor breach tests the contract, the tier and the inventory built in earlier sections. The team has to answer three things fast: what the vendor held, what an attacker can reach from there, and whether it matters to investors. Four steps cover that ground.

The four steps

1. Take notice under the contract. Record the time, sender and channel of the vendor's notice, then check it against the notification clause in the agreement. Ask in writing for affected data types, indicators of compromise and the vendor's timeline. Name one internal owner for the vendor relationship until the incident closes.

2. Scope internal exposure. Pull the vendor's record from your inventory: the data you shared, accounts and API keys it holds, and network paths into your environment. Rotate the credentials and tokens it held, and search your logs for activity from its accounts. A worked case: a payroll processor reports a breach, so the team lists every employee record sent to it and every service account it used, then reviews those accounts' sign-ins.

3. Log the incident as your own. Open a ticket in your incident system even if no system you own was touched. Write down what you knew and when you learned it, with timestamps. In our reading, this record does double duty. The SEC's 2011 staff guidance pointed to accounting standards including 450-20 (Loss Contingencies), so finance may draw on the same log later.

4. Run the materiality assessment. The adopting release states the SEC is adopting amendments to require current disclosure about material cybersecurity incidents. Keep three dates apart in the log: the day the vendor's notice arrived, the day scoping finished and the day the company reached its materiality decision. Filing timing under Form 8-K Item 1.05 and how the deadline is counted are covered in our materiality decision guide. Bring legal and finance in early. The 2018 interpretive release advised companies to consider whether it may be appropriate to implement restrictions on insider trading in the period after an incident and before disclosure.

What a reader can check in filings

The older staff guidance stated that material information about cyber incidents is required to be disclosed when necessary in order to make other required disclosures, in light of the circumstances under which they are made, not misleading. A reader can look at whether a company that reported a vendor incident also updated its risk factors in the next annual report.

Before the rule, the release notes, registrants that reported material incidents did so most typically on Form 10-K. Compare that with current reports in our disclosures tracker and cyber incident reports. In our reading, the useful test is whether the 8-K names the vendor's role and when the company learned of it.

This section describes what the rules and filings say. It is not legal advice.

A first-year third-party risk program for a mid-sized security team

This is our own view of how a mid-sized team can stand up a third-party program in twelve months. It assumes no tooling budget beyond a spreadsheet and the contract system you already have. Each quarter ends with one thing you can show your boss.

First quarter: inventory and owners

Start with accounts payable, not a survey. Every vendor that gets paid is on that list, including the small ones that hold data. Add single sign-on applications and anything with a network connection into your environment.

Give each vendor one internal owner from the business, not from security. That person answers for the relationship and signs off on renewals. Without an owner, findings in the third quarter have nowhere to go.

Second quarter: tiers and contracts

Use the tiering approach from earlier in this guide and write the rule down in one page. Then fix the paper. Draft a standard security exhibit covering breach notice, audit rights and data return, and get legal to attach it to every new or renewing contract.

This is also the quarter to write the policy itself. NIST's supply-chain publication includes guidance on the development of strategy implementation plans, policies and plans for cybersecurity supply chain risk management (C-SCRM), which gives you a structure to borrow even if you are not a federal agency. The SEC's 2018 guidance also addressed the importance of cybersecurity policies and procedures.

Third quarter: assess the top tier

Assess only the top tier this year. Read their attestation reports, ask the questions the reports leave open, and log every gap with a fix date. In our reading, a short, closed finding log is worth more to an auditor than a long questionnaire archive.

Fourth quarter: board reporting and offboarding

Build one page for the board: top-tier vendors, open findings, and anything past due. Keep it separate from unrelated material. SEC staff found that disclosures were sometimes included with other unrelated disclosures, which makes it more difficult for investors to find them, and we think the same holds for a board pack. Our guide to SEC disclosure rules covers what feeds the annual filing.

Then write the exit checklist: revoke access, confirm data return or destruction, close the contract record.

What this guide does not cover

This guide does not cover SEC filing mechanics or how the Form 8-K Item 1.05 deadline is counted, which our other guides address, and it does not say how the rules apply to any one company. It does not rank or recommend vendors or tools. It is not legal advice, and counsel should confirm which compliance dates and obligations apply to your company. For the rules and the record behind it, see SEC Cybersecurity Disclosure Rules for CISOs: Item 1.05, Item 106 and Item 1C Explained.