Lion Cipher Lab

Build a C-SCRM plan and tailor controls under NIST SP 800-161r1

• GRC / Compliance
• Advanced
• ~75 min
• Free · no account required

Why it matters

Most breaches that make the news do not start with a flaw in code the victim wrote — they arrive through the supply chain: a compromised software update (SolarWinds), a vulnerable open-source library buried three dependencies deep (Log4Shell), a hardware component with untrusted provenance, or a cloud provider outage that takes the whole product down. That is the C-SCRM problem: you are responsible for risk you did not create and often cannot even see, because it lives in the code, hardware, and services you bought or imported rather than built. NIST SP 800-161r1 (Cybersecurity Supply Chain…

What you'll learn

• framing the Cybersecurity Supply Chain Risk Management (C-SCRM) problem — the risk carried by the code, hardware, and services you did NOT build and cannot fully see
• laying out the NIST SP 800-161r1 three-tier structure (Tier 1 enterprise / Tier 2 mission-and-business-process / Tier 3 operational) and tracing how C-SCRM decisions cascade across it
• running a criticality analysis in the NISTIR 8179 style: decomposing a mission into functions, assigning criticality levels, and identifying which supplier/component failure has the highest consequence
• performing a supplier risk assessment against likelihood x impact, foreign-ownership and geographic-concentration factors, and SBOM demands
• selecting and TAILORING C-SCRM controls from the 800-161r1 families (the SR Supply Chain Risk Management family plus SA, RA, and PM) to a specific supplier and tier — not applying a flat checklist
• assembling the required C-SCRM plan sections and a POA&M-style residual-risk register that tracks each weakness to a remediation and milestone
• articulating the distinction between C-SCRM and classic third-party/vendor risk management (TPRM), and where C-SCRM connects to SBOM and Executive Order 14028
• being honest about the hard limit of the discipline: you rarely get real visibility below your tier-1 suppliers, and a good plan says so

Steps in this lab

1. The scenario, and the artifact you will produce
2. Part 1 — The three-tier structure: who decides what, and how it cascades
3. Part 2 — Criticality analysis: which supplier failure hurts the mission most?
4. Part 3 — Supplier risk assessment: how likely, how bad, and the foreign-ownership factor
5. Part 4 — Tailor controls from the 800-161r1 families to the supplier and tier
6. Part 5 — Assemble the C-SCRM plan document sections
7. Part 6 — The POA&M residual-risk register
8. The judgment: C-SCRM vs TPRM, SBOM/EO 14028, and the honest limits

Open the full interactive lab →