Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems
Jeremy Miller2, Julie Snyder

Jeremy Licata, Rebecca McWhite, Laura Calloway

Computer Security Division
Information Technology Laboratory

Dylan Gilbert1, Meghan Anderson

Applied Cybersecurity Division
Information Technology Laboratory

Jeremy Miller2, Julie Snyder

The MITRE Corporation
1 Former NIST employee; all work for this publication was done while at NIST.
2 Former MITRE employee; all work for this publication was done while at MITRE.
Howard Lutnick, Secretary of Commerce
Arvind Raman, NIST Director and Under Secretary of Commerce for Standards and Technology
Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this
paper in order to specify the experimental procedure adequately. Such identification does not imply
recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or
equipment identified are necessarily the best available for the purpose.
There may be references in this publication to other publications currently under development by NIST in
accordance with its assigned statutory responsibilities. The information in this publication, including concepts and
methodologies, may be used by federal agencies even before the completion of such companion publications.
Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist,
remain operative. For planning and transition purposes, federal agencies may wish to closely follow the
development of these new publications by NIST.
Organizations are encouraged to review all draft publications during public comment periods and provide feedback
to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at
https://csrc.nist.gov/publications.
Authority
This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal
Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is
responsible for developing information security standards and guidelines, including minimum requirements for
federal information systems, but such standards and guidelines shall not apply to national security systems
without the express approval of appropriate federal officials exercising policy authority over such systems. This
guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130.
Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and
binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines
be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the
OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary
basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.
NIST Technical Series Policies
Copyright, Use, and Licensing Statements
NIST Technical Series Publication Identifier Syntax
Publication History
Approved by the NIST Editorial Review Board on 2026-05-26
Supersedes NIST SP 800-18r1 (February 2006) https://doi.org/10.6028/NIST.SP.800-18r1
How to Cite this NIST Technical Series Publication
Licata J, McWhite R, Calloway L, Gilbert D, Miller J (2026) Developing Security, Privacy, and Supply Chain Risk
Publication (SP) NIST SP 800-18r2. https://doi.org/10.6028/NIST.SP.800-18r2
Author ORCID iDs
Meghan Anderson: 0009-0004-2875-5672
Laura Calloway: 0000-0003-4045-7307
Dylan Gilbert: 0009-0003-6061-3757
Jeremy Licata: 0000-0001-8793-5471
Rebecca McWhite: 0009-0000-9092-3500
Jeremy Miller: 0009-0004-3119-8803
Julie Snyder: 0009-0004-6352-2831
Contact Information
sec-cert@nist.gov
Attn: Computer Security Division, Information Technology Laboratory
100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930
Additional Information
Additional information about this publication is available at https://csrc.nist.gov/pubs/sp/800/18/r2/final,
including related content, potential updates, and document history.
All comments are subject to release under the Freedom of Information Act (FOIA).