Supply Chain Risk Management Frameworks: A Practical Comparison
NIST SP 800-161, ISO 28000, NIS2, DORA, multiple frameworks apply to supply chain risk management, and for EU organisations, some of them are mandatory. This guide explains each one, compares them, and shows how StartComply maps to all of them in a single platform.
This page focuses on supply chain frameworks such as NIST SP 800-161 and ISO 28000. For vendor-specific frameworks, see the vendor risk management framework. For third-party-specific frameworks, see the third-party risk management framework.
Trusted by 100+ organisations across Europe
NIS2 Article 21 
DORA Chapter V 
NIST SP 800-161 
ISO 27001:2022 What you need to know about SCRM frameworks
- NIST SP 800-161, ISO 28000, NIS2, and DORA each address supply chain risk differently. NIS2 and DORA are mandatory for in-scope EU organisations.
- NIST SP 800-161 is the most-used voluntary framework for cyber supply chain risk management. It maps closely to NIS2 Article 21.
- ISO 27001 certification covers externally provided processes, Clause 8.4, but does not satisfy NIS2 or DORA supply chain requirements alone.
- Adopt one C-SCRM methodology, typically NIST 800-161. Map your program activities to NIS2 Article 21 and DORA Chapter V simultaneously.
- Framework selection is a means to an end. The risk is debating frameworks for months instead of building the program.
Sources: NIS2 Directive, DORA Regulation.
What Is a Supply Chain Risk Management Framework?
A supply chain risk management framework is a structured set of principles, requirements, and controls that an organisation adopts to identify, assess, and manage supply chain risks in a consistent, repeatable, and auditable way.
Frameworks give your SCRM program methodological credibility. They create a shared language for internal stakeholders and external auditors. They help ensure completeness. And they can satisfy regulatory expectations and reduce compliance friction.
The distinction EU-regulated organisations need to hold onto:
A regulation is law. Compliance is mandatory. NIS2 and DORA are regulations.
A standard is a documented specification from a recognised body. ISO 28000 is a standard.
A framework provides principles and practices. NIST SP 800-161 operates as a framework.
A policy is your internal document defining your organisation’s own requirements and approach.
Adopting voluntary frameworks does not replace mandatory compliance with NIS2 and DORA. The framework is your how. The regulation is your what.
StartComply maps every SCRM program activity simultaneously to the frameworks and regulations that apply to your organisation, so you do not need separate tools for each.
Simple rule: mandatory regulations define what you must prove. Frameworks help you structure how the program works.
The Major SCRM Frameworks: What Each One Covers
NIST SP 800-161: Cybersecurity Supply Chain Risk Management
Published by the US National Institute of Standards and Technology, NIST SP 800-161 Revision 1 is the reference framework for cyber supply chain risk management, C-SCRM. Despite its US origins, organisations across Europe use it as their C-SCRM methodology. It maps closely to NIS2 Article 21 supply chain security requirements.
The framework organises C-SCRM at three levels:
- Organisation-wide: policy, strategy, governance, and risk appetite
- Mission and business process: translating strategy into supply chain-specific processes and controls
- System and operational: implementing controls for specific systems and supplier relationships
Key practices include C-SCRM policy approved by senior management, supplier classification and assessment, security requirements flowing down to sub-suppliers, contractual security provisions, and ongoing monitoring.
ISO 28000: Supply Chain Security Management Systems
ISO 28000 provides a certifiable management system framework for supply chain security. It follows the ISO Annex SL structure, the same format as ISO 27001, which means it integrates well with other management systems you already run.
It is useful for organisations that want third-party assurance around supply chain security, especially where customers, regulators, or partners expect a formal management system. It supports structured governance, documented controls, monitoring, review cycles, and continuous improvement.
ISO 27001:2022 Clause 8.4 covers externally provided processes and overlaps with SCRM, but ISO 27001 certification alone does not satisfy NIS2 or DORA supply chain requirements.
C-TPAT: Customs-Trade Partnership Against Terrorism
C-TPAT is a US Customs and Border Protection programme focused on physical supply chain security at international borders. It is relevant for organisations with US import and export operations, especially where physical goods, customs processes, and cross-border logistics are central to the supply chain.
Its relevance to cybersecurity supply chain risk is limited. C-TPAT can support physical supply chain security, but it does not replace a C-SCRM methodology, NIS2 Article 21 compliance, or DORA Chapter V requirements.
NIS2 and DORA: Mandatory EU Frameworks
For EU-regulated entities, NIS2 Article 21 and DORA Chapter V are not optional frameworks. They are law.
NIS2 Article 21 prescribes supply chain security as one of ten mandatory cybersecurity measures. DORA Chapter V prescribes a comprehensive ICT third-party risk management framework for financial entities, including a documented policy, a complete register, due diligence requirements, contractual provisions, ongoing monitoring, and exit strategies.
The practical approach is to use a methodology such as NIST SP 800-161 to structure your program, then map every activity to the legal requirements of NIS2 and DORA. StartComply does this mapping inside one platform.
Practical rule: use NIST SP 800-161 as your C-SCRM methodology, then map the same activities to NIS2 Article 21 and DORA Chapter V for regulatory evidence.
How StartComply Maps to Each Framework
NIST SP 800-161 Coverage
StartComply’s assessment methodology aligns with NIST SP 800-161 C-SCRM practices: supplier identification, criticality classification, assessment and due diligence, flow-down requirements, and ongoing monitoring. Every SCRM activity maps to the relevant NIST practice area.
- Organisation-level C-SCRM policy support
- NIST-aligned supplier assessment questionnaires
- Sub-contractor flow-down requirement tracking
- Audit evidence organised by NIST practice
NIS2 Article 21 Compliance
Every supply chain risk management activity in StartComply tags to the NIS2 Article 21 requirement it satisfies. Supplier assessments, contractual requirement tracking, incident notification workflows, and monitoring all produce evidence mapped to specific NIS2 obligations.
- Article 21 compliance posture dashboard
- Gap identification by requirement
- Audit-ready evidence packages by Article 21 section
- Incident escalation aligned with NIS2 24-hour reporting
DORA Chapter V Compliance
StartComply’s ICT provider register satisfies DORA Article 28 register of information requirements out of the box. Assessment workflows, contractual provision tracking, monitoring, and exit strategy documentation all produce DORA-mapped evidence.
- DORA Article 28 ICT register ready on day one
- Article 30 contractual requirement tracking
- Exit strategy documentation workflows
- DORA incident classification aligned with the 4-hour window
Framework Comparison: NIST SP 800-161 vs ISO 28000 vs NIS2 vs DORA
A side-by-side view of the four frameworks and regulatory requirements most relevant to supply chain risk management programs in EU-regulated organisations.
Use the table as a practical shortcut: NIST SP 800-161 gives the C-SCRM method, ISO 28000 supports certifiable supply chain security governance, while NIS2 and DORA define the mandatory EU evidence obligations.
How to Choose the Right SCRM Framework
Identify your mandatory requirements first. If NIS2 applies, Article 21 is non-negotiable. If DORA applies, Chapter V is non-negotiable.
Select a methodology framework for implementation. NIST SP 800-161 provides one of the most comprehensive cyber supply chain risk management methodologies for EU organisations.
Consider whether certification adds value. If customers, regulators, or partners expect third-party assurance of your supply chain security, ISO 28000 certification may support that requirement.
Start building. Framework selection is only useful when it becomes an operational program with supplier inventory, assessments, monitoring, evidence, and clear ownership.
Need the cyber supply chain view?
For the full guide including NIST SP 800-161 in depth, read Cyber Supply Chain Risk Management.
Framework Questions: Answered
What is the NIST supply chain risk management framework?
NIST SP 800-161 Revision 1 is published by the US National Institute of Standards and Technology. It provides practices for managing cybersecurity risks across supply chains at three levels: organisation-wide strategy, mission/business process, and system/operational. It covers C-SCRM policy, supplier assessment, contractual requirements, and ongoing monitoring. Organisations globally use it as their C-SCRM methodology, and it maps closely to NIS2 Article 21 requirements.
Does ISO 27001 certification cover supply chain risk management?
Partially. ISO 27001:2022 Clause 8.4 covers management of externally provided processes and services, which overlaps with SCRM. But ISO 27001 certification does not satisfy the supply chain risk management requirements of NIS2 Article 21 or DORA Chapter V. Organisations in NIS2 or DORA scope need a dedicated SCRM program beyond the ISO 27001 scope.
What framework does NIS2 require for supply chain risk?
NIS2 does not mandate a specific framework. It requires that essential and important entities manage supply chain security risks systematically and demonstrate it. Organisations commonly use NIST SP 800-161 as their C-SCRM methodology while structuring their program to satisfy NIS2 specific Article 21 requirements. StartComply maps both simultaneously.
Can we implement multiple SCRM frameworks at the same time?
Yes. A common combination for EU-regulated organisations: NIS2 and DORA for mandatory regulatory compliance, NIST SP 800-161 for C-SCRM methodology, and ISO 27001 for the broader information security management system. StartComply maps all of them in one platform without requiring separate tools or duplicate processes.
Is SCRM the same as TPRM?
Not exactly. TPRM, Third-Party Risk Management, covers all risks from any external party. SCRM focuses specifically on the supply chain structure, including multi-tier relationships and cascading failure risk. In EU regulatory language, NIS2 uses supply chain security and DORA uses ICT third-party risk management. StartComply handles both as a unified program.
Client Testimonials
“We evaluated enterprise platforms costing 10x more. StartComply does what we need at a price that makes sense.”Elena Kowalski
“Finally, a compliance tool that understands European regulations. StartComply got us audit-ready in weeks, not months.”Maria Papadopoulou
“The AI policy engine alone saved us hundreds of hours. And the third-party risk management is exactly what DORA requires.”Thomas Müller
