feat: add NIST SP 800-161 Cybersecurity Supply Chain Risk Management skill

[sjackson0109]

NIST SP 800-161 Rev 1 — Cybersecurity Supply Chain Risk Management (C-SCRM)

Source Publication: NIST Special Publication 800-161 Revision 1, May 2022
CSRC URL: https://csrc.nist.gov/publications/detail/sp/800-161/rev-1/final

This pull request adds a complete Claude skill plugin for NIST SP 800-161 Rev 1, supporting CIOs, SAORMs, C-SCRM Programme Managers, ISSOs, Contracting Officers, and acquisition professionals implementing cybersecurity supply chain risk management programmes for federal information systems and organisations.

---

Files Added

plugins/nist-sp-800-161/
  .claude-plugin/plugin.json
  skills/nist-sp-800-161/
    SKILL.md
    references/
      sr-control-family.md
      supplier-assessment.md
      c-scrm-programme.md

---

Framework Coverage

C-SCRM Scope: Full ICT supply chain lifecycle from design through disposal. Addresses hardware, software, cloud services, SaaS, FOSS, COTS, managed services, and all sub-tier suppliers.

Supply Chain Threats: Six threat categories — counterfeit components, tampered products, inferior and fraudulent products, theft of sensitive information, installation of malicious code, poor manufacturing/development practices.

Multi-Tier Architecture: Three C-SCRM tiers aligned to SP 800-39 — Tier 1 (Enterprise: strategy, risk tolerance, governance), Tier 2 (Mission/Business: programme/project level), Tier 3 (Information System: SR control implementation). Supplier tier hierarchy: prime contractor, sub-tier supplier, component manufacturer.

SR Control Family: All 12 base controls (SR-1 through SR-12) plus all enhancements with baseline assignments (L/M/H) and detailed implementation guidance. Covers provenance, supplier assessments, acquisition strategies, tamper resistance, component authenticity, and disposal.

SBOM: NTIA minimum 7 data fields, SPDX and CycloneDX formats, delivery requirements, consumption procedure with NVD cross-reference, retention guidance. Aligned to EO 14028 software supply chain security requirements.

Supplier Risk Tiering: 7-factor scoring matrix (geography, ownership, prior incidents, certifications, sub-tier visibility, single-source dependency, component sensitivity) yielding Low/Moderate/High/Critical tier classification.

Supplier Assessments: Five assessment types matched to risk tier. Frequency guidance. Triggers for unscheduled reassessment.

Acquisition Lifecycle: C-SCRM requirements mapped to six acquisition phases (requirements definition through disposal). Pre-solicitation checklist, delivery/acceptance procedure, supply chain incident response.

Contract Clauses: Eight model clauses covering security requirements flow-down, incident/vulnerability notification (72 hours), significant change notification, EOL announcement, authenticity warranties, SBOM delivery, right-to-audit, and ownership change notification.

---

Reference Files

references/sr-control-family.md — Detailed implementation guidance for all SR controls (SR-1 through SR-12) and enhancements. Baseline assignments. Implementation notes addressing cloud, FOSS, and COTS scope. Hardware and software anti-counterfeiting techniques (SR-11). Tamper resistance technologies (SR-9). Provenance documentation fields (SR-4). Component disposal requirements (SR-12).

references/supplier-assessment.md — 7-factor supplier risk tiering worksheet with scoring interpretation. Abbreviated supplier assessment questionnaire (5 sections). 8 model C-SCRM contract clauses ready for legal review. SBOM minimum data fields (NTIA), recommended additional fields, format and delivery requirements. SBOM consumption procedure. Critical Component Identification Worksheet template.

references/c-scrm-programme.md — 7-step C-SCRM programme establishment procedure. Complete C-SCRM Plan template with all 12 required sections. Pre-solicitation C-SCRM checklist (10 items). Delivery and acceptance procedure for critical/high-risk components. 5-step supply chain incident response procedure (identify/assess, contain, notify, eradicate/recover, document). 7 programme-level C-SCRM metrics with measurements, targets, and reporting levels.

---

Integration Points

• SP 800-53 Rev 5: SR control family is defined in SP 800-53 Rev 5; this skill provides SP 800-161 implementation guidance
• SP 800-37 Rev 2 RMF: C-SCRM requirements integrated throughout the RMF lifecycle; SR controls appear in system security plans
• SP 800-30 Rev 1: supply chain risk assessment methodology follows SP 800-30 risk determination approach
• SP 800-218 SSDF: secure development requirements for software suppliers align to SSDF practices
• EO 14028: SBOM requirements align to Executive Order 14028 Section 4 software supply chain security

---

Tests

python -m pytest tests/test_plugin_structure.py -v -k "nist-sp-800-161"

tests/test_plugin_structure.py::TestPluginDirectory::test_plugin_json_exists[nist-sp-800-161] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_plugin_json_is_valid[nist-sp-800-161] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_plugin_json_required_fields[nist-sp-800-161] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_plugin_version_semver[nist-sp-800-161] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_skills_directory_exists[nist-sp-800-161] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_skills_directory_has_one_skill_folder[nist-sp-800-161] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_skill_md_exists[nist-sp-800-161] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_skill_md_not_empty[nist-sp-800-161] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_no_files_outside_skill_folder[nist-sp-800-161] PASSED
tests/test_plugin_structure.py::TestPluginDirectory::test_references_are_markdown[nist-sp-800-161] PASSED

10 passed, 95 deselected in 0.09s