The American National Standards Institute (ANSI) encourages its members to submit feedback on the National Institute of Standards and Technology’s (NIST) second public draft of Special Publication (SP) 800-161 Revision 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, open to public comment. Responses, due by December 3, 2021, will help NIST to carry out one of its multiple assignments in the President’s Executive Order (EO) 14028, Improving the Nation’s Cybersecurity.
NIST’s initial public draft, published in April 2021, preceded the release of the EO, which emphasizes the Administration’s top priority to support prevention, detection, assessment, and remediation of cyber incidents, essential to national and economic security. The EO tasked multiple agencies—including NIST—“with enhancing cybersecurity through a variety of initiatives, but with a specific focus on the security and integrity of the software supply chain.”
Background on the Second Public Draft of Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations
NIST reports that the amended draft provides more consumable content for different audiences, with a revised document structure and new “Audience Profiles.” NIST has also added two new appendices focused more specifically on federal departments and agencies. These include:
NIST requests comments by December 3, 2021, and provides a template for comment submissions, along with instructions and more information, on its website.