1. Home
  2. |Insights
  3. |Draft NIST Guidance Highlights Supply Chain Fundamentals as Key Practices in Cyber Supply Chain Risk Management

Draft NIST Guidance Highlights Supply Chain Fundamentals as Key Practices in Cyber Supply Chain Risk Management

Client Alert | 1 min read | 02.21.20

Last week, the National Institute of Standards and Technology (NIST) published the draft NISTIR 8276 “Key Practices in Cyber Supply Chain Risk Management” providing Key Practices and related recommendations for monitoring, controlling, and understanding how to conduct cyber – supply chain risk management (C-SCRM). The Eight Key Practices are general and apply equally, in practice, to both traditional supply chain management and C-SCRM, including:

  • Integrating SCRM across the organization,
  • Understanding the organization’s supply chain, and
  • Assessing and monitoring SCRM throughout the supplier relationship. 

Specific guidance includes, among others:

  • Increasing Board involvement in C-SCRM;
  • Understanding the cyber relationship with suppliers, including whether they process critical data; and
  • Using third-party assessments to evaluate suppliers.

The guidance should serve to remind organizations of the need to know their supply chain well and to have a purposeful approach to its management. Organizations have an opportunity to comment on this draft guidance until March 4, 2020.

Insights

Client Alert | 6 min read | 07.17.25

Code of Practice for General-Purpose AI Models Published: Compliance Just Got Clearer (Participation Still Optional)

On 11 July 2025, the European Commission published the final version of its Code of Practice for General-Purpose Artificial Intelligence (GPAI). This Code is meant to serve as a tool for GPAI model providers, helping them to comply with the transparency, copyright and security provisions governing general-purpose AI models as set out in the AI Act (arts. 53 and 55), which will become applicable on 2 August 2025. Adherence to the Code is on a voluntary basis....