Executive briefing
NIST SP 800-18 Revision 2: what you need to know
Released June 30, 2026
A plain-English briefing for third-party risk leaders. Ten minutes here instead of sixty pages of standard, with the parts that touch your program pulled to the front.
Download Report2006 -> 2026 · Supersedes the 2006 edition
Download ReportFirst revision since
2006
System plans now required
3
New system-level plan
C-SCRM
2006 -> 2026 · Supersedes the 2006 edition
The whole thing, in six lines
If you read nothing else
NIST updated SP 800-18 in June 2026, its first revision since 2006. The important shift for third-party risk teams is that system plans now mean three plans, not one: a system security plan, a system privacy plan, and a cybersecurity supply chain risk management plan.
Old model
OneplanOne planOne
plan
Revision 2
ThreeplansThree plansThree
plans
New TPRM layer
C-SCRM
Review cadence
Continuous
The C-SCRM plan is the new piece. It lives at the system level, with a supplier and component inventory, criticality ratings, and named supplier relationships.
NIST also pushes these plans toward living, machine-readable data that can feed GRC, SOAR, and SIEM tools. The standard deliberately moves away from static, point-in-time documents.
For federal systems, this is required. For everyone else, it is voluntary guidance, but it sets the direction examiners, auditors, and frameworks tend to follow.
Old model vs. Revision 2
Supplier risk
From one enterprise vendor policy filed once to a C-SCRM plan per system, with supplier and component inventories.
Evidence
From static PDFs and questionnaires to machine-readable data feeding GRC, SOAR, and SIEM.
Cadence
From an annual review snapshot to living plans, continuous monitoring, and event-driven reviews.
Scope
From enterprise-level policy to a system-level view tied to the systems each supplier touches.
Four shifts that matter
Revision 2 changes the center of gravity for third-party risk. Supply chain risk is no longer a paragraph inside a security document. It has its own plan, inventory, and owner.
What changed
The biggest change for TPRM
The C-SCRM plan sits at the system level. A company-wide vendor policy does not answer how a specific system manages risk from the suppliers and components that support it.
01
Supply chain risk became its own plan
SP 800-18 now treats the system security plan, system privacy plan, and C-SCRM plan together as system plans.
02
The C-SCRM plan sits at the system level
It draws from the organization's C-SCRM strategy, but describes how a specific system manages supplier and component risk.
03
Data replaces documents
NIST points to OSCAL and automated collection through the GRC, SOAR, and SIEM tools teams already run.
04
Monitoring becomes continuous and event-driven
Plans should be reviewed when a supplier breach, ownership change, foreign-influence review, or new critical component changes the risk picture.
Plain-English read
The annual questionnaire cycle is no longer the unit of measurement. The standard expects living system plans and alerts when critical supplier changes affect risk posture.
Three plans, one system view
Revision 2 defines three system plans. They can be written separately or consolidated into one document that shares common elements such as system name, boundary, and roles.
The system security plan covers the system's security requirements and the controls that protect confidentiality, integrity, and availability across the system's life.
The system privacy plan covers privacy risks from both cybersecurity events and ordinary data processing, built around predictability, manageability, disassociability, and individuals' rights over their data.
The cybersecurity supply chain risk management plan is the one that touches TPRM. It carries the system's supply chain requirements, supplier and component inventory, criticality ratings, named supplier relationships, and controls to manage and monitor the supply chain across the system's life.
Consolidation note
Combining the three plans can be useful because cybersecurity, privacy, and supply chain incidents often overlap.
What the C-SCRM plan actually asks for
If you own third-party risk, these are the concrete things the standard now expects you to be able to show for each in-scope system.
The part that touches your program
A supplier and component inventory, tied to the system
Which suppliers and components support this system, each rated for criticality, with key supplier roles named. For software, this reaches into the SBOM, provenance and pedigree, secure development attestation, and country of origin.
Governance
Named supplier relationships
The plan defines relationships between key suppliers and the system owner: roles, responsibilities, expectations, performance management, and supplier governance.
System-level risk
Supply chain risk managed per system
Policy implementations, constraints, and risk responses are specific to the system's supply chain and drawn from organizational strategy and risk tolerance.
Monitoring
Continuous monitoring of critical suppliers
The system owner should be alerted when a supplier change could affect the system's risk posture, instead of waiting for the next scheduled review.
Evidence
Machine-readable and automated
Evidence should live in a central repository, be machine-readable where possible, and feed the GRC, SOAR, and SIEM tools the organization already runs.
Event-driven reviews
Reviews should be triggered by supplier breaches, ownership changes, mergers and acquisitions, foreign ownership or influence reviews, and new critical components, not only the calendar.
What to do now
Regulated enterprises are not suddenly legally required to comply just because NIST published the revision. But examiners, auditors, and frameworks track NIST. Programs still running on annual questionnaires are the ones caught short when expectations catch up.
01
List in-scope systems
Identify which systems have a real C-SCRM plan versus only an enterprise vendor policy. Start with high and moderate impact systems.
02
Build system-level inventories
Create supplier and component inventories per system, with criticality, named supplier roles, SBOM, provenance, and country of origin where relevant.
03
Map suppliers to controls
Document which systems each supplier touches, which controls they affect, and how each system manages that supply chain risk.
04
Monitor critical suppliers
Stand up alerts for posture-changing events such as breach, ownership change, foreign-influence review, and certificate expiry.
05
Centralize machine-readable evidence
Move evidence into data that feeds GRC, SOAR, and SIEM tools, and retire the static-document-only approach. Consider OSCAL for representation.
06
Keep plans living and auditable
Define roles, review records, and change records, and decide whether to consolidate the three system plans into one.
01
List in-scope systems
Identify which systems have a real C-SCRM plan versus only an enterprise vendor policy. Start with high and moderate impact systems.
02
Build system-level inventories
Create supplier and component inventories per system, with criticality, named supplier roles, SBOM, provenance, and country of origin where relevant.
03
Map suppliers to controls
Document which systems each supplier touches, which controls they affect, and how each system manages that supply chain risk.
04
Monitor critical suppliers
Stand up alerts for posture-changing events such as breach, ownership change, foreign-influence review, and certificate expiry.
05
Centralize machine-readable evidence
Move evidence into data that feeds GRC, SOAR, and SIEM tools, and retire the static-document-only approach. Consider OSCAL for representation.
06
Keep plans living and auditable
Define roles, review records, and change records, and decide whether to consolidate the three system plans into one.
Required for federal, voluntary for the rest
Federal systems must develop these plans under OMB Circular A-130 and FISMA. For banks, credit unions, insurers, and private firms, NIST says the guidelines may be applied voluntarily.
The honest read for a regulated enterprise is not that you are now legally required to comply. It is that NIST has written down continuous, control-based, system-level supply chain risk as the reference point the industry will increasingly measure against.
The C-SCRM plan, made operational
Most of what Revision 2 asks for on the supply chain side is what Coverbase does day to day. This mapping is deliberately limited to the third-party dimension, where the fit is real.
Where Coverbase fits
Supplier and component inventory with criticality
Autonomous Intake, living vendor profiles, and Fourth-Party Monitoring help keep supplier and component evidence current.
Governance
Supplier relationships, roles, obligations, governance
Workflow Autopilot, Case Manager, and Obligations Tracker keep supplier expectations and ownership tied to operational workflows.
Controls
Supply chain risk managed per system
Risk Assessment Copilot supports custom control sets so teams can assess and document supplier risk against the systems and controls that matter.
Monitoring
Continuous monitoring and event-driven reviews
Supplier Radar works like a third-party SIEM, with incident-to-score loops and Copilot delta detection for breach or ownership changes.
Evidence
Machine-readable evidence into GRC, SOAR, and SIEM
Zero-Touch Assessments, API integrations, ServiceNow, ProcessUnity, Aravo, Archer, Risk Assessment Copilot, and Findings Manager turn evidence into operational data.
Honest scope note
Coverbase is built for the supply chain side of SP 800-18r2: supplier and component evidence, monitoring, and machine-readable output. It does not author your internal system security or privacy plans.