SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-cscrm-supply-chain

NIST describes C-SCRM as a systematic process for managing cybersecurity risk exposure where?

Throughout the supply chain, including suppliers and vendors.

Start playing free

  1. Throughout the supply chain ✔
  2. Only inside the company's data center
  3. Only when a contract is first signed

Why: Your security depends on your vendors' software, hardware and services. Cybersecurity supply chain risk management identifies, assesses and mitigates that risk across the whole chain. It is ongoing, not a one-time check.

Huh, didn't know that: NIST says C-SCRM should be directed as an enterprise-wide activity from a governance level.

The dad joke
My vendor said their security was great. I asked for proof. They sent a very confident email.
Like this card?
Play the game

References

Answer: Throughout the supply chain. Your security depends on your vendors' software, hardware and services. Cybersecurity supply chain risk management identifies, assesses and mitigates that risk across the whole chain. It is ongoing, not a one-time check.

  1. NIST SP 800-161 Rev. 1 Update 1, Cybersecurity Supply Chain Risk Management Practices nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-161r1-upd1.pdf
    Cybersecurity Supply Chain Risk Management (C-SCRM) is a systematic process for managing exposure to cybersecurity risks throughout the supply chain
    Checked 2026-10-11.
  2. NIST SP 800-161 Rev. 1 Update 1, Cybersecurity Supply Chain Risk Management Practices nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-161r1-upd1.pdf
    C-SCRM is an enterprise-wide activity that should be directed as such from a governance perspective
    Checked 2026-10-11.
  3. NIST SP 800-161 Rev. 1 Update 1, Cybersecurity Supply Chain Risk Management Practices nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-161r1-upd1.pdf
    Supersedes NIST Special Publication 800-161r1 (May 2022)
    Checked 2026-10-11.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyEncrypting a laptop's files mainly protects which part of the CIA triad?Security & PrivacyA file's hash value no longer matches after someone edits the file. Which CIA property was affected?Security & PrivacyA flood of fake traffic knocks a website offline. Which CIA property does this attack target?

That's stuff everyone should know.