FISMA Third-Party Risk: Contractor Systems and the NIST SP 800-53 SR Family

Does FISMA make an agency responsible for its contractors’ systems?

Yes. The Federal Information Security Modernization Act of 2014 (FISMA) makes the head of each agency responsible for information security protections for “information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency.” The agency-wide security program FISMA requires has to cover information systems “provided or managed by another agency, contractor, or other source.” A contractor-run system that supports your mission is inside your FISMA boundary of responsibility, whether or not it sits in your data center.

That has practical consequences. Your annual FISMA reporting, your Inspector General’s independent evaluation, and your authorizing official’s risk decisions all reach systems you do not run. And since the 2018 SECURE Technology Act amendments, FISMA also tells agency heads to carry out their responsibilities for assessing and avoiding, mitigating, transferring, or accepting supply chain risks under 41 U.S.C. 1326.

NIST SP 800-53 Revision 5 turns that into controls. Its Supply Chain Risk Management (SR) family, added in Revision 5, sets out what an agency, or a contractor operating a system on its behalf, is expected to do about suppliers. The gap most programs face is not knowing the controls. It is producing evidence for them across hundreds of suppliers, continuously, with a staff sized for a fraction of that.

What does this page cover?

FISMA’s third-party scope, the SR controls that matter most for vendor oversight, how recent OMB policy on software security changed what agencies ask of software producers, and a framework you can run. It is written for agency CISOs, ISSOs, and supply chain risk teams, and for contractors who operate systems on an agency’s behalf.

Why do FISMA supplier programs fall short?

Failure 1: The system inventory does not show supplier dependencies

FISMA testing must cover every system in the agency inventory, at a frequency based on risk and no less than annually. Most inventories list systems, not the suppliers behind them. The SaaS platform behind a case management system, the managed service provider with admin access, the component vendor whose firmware runs in field equipment: if the record does not link them, the SR controls cannot be applied consistently. Start with a governed supplier intake that captures the system, the data, and the access.

Failure 2: Supplier assessment happens at acquisition and then stops

SR-6 (Supplier Assessments and Reviews) expects suppliers to be assessed and reviewed, not just vetted once. Many agencies do serious work at acquisition, through the solicitation, the security requirements, and the authorization package, and then rely on the contractor’s annual self-report. A supplier’s posture can change in a week.

Failure 3: Notification agreements are vague

SR-8 (Notification Agreements) asks for agreements with suppliers on notification of supply chain compromises and assessment results. FISMA requires agencies to notify Congress of a major incident within seven days of having a reasonable basis to conclude one occurred. If the contract does not oblige the supplier to tell you quickly and specifically, your clock starts late.

Failure 4: The SR family is treated as a hardware problem

Controls such as SR-9 (Tamper Resistance and Detection), SR-10 (Inspection), and SR-11 (Component Authenticity) read like hardware controls, and teams sometimes scope the whole family to procurement of physical components. SR-2, SR-3, SR-5, SR-6, and SR-8 apply just as much to software and services. The SaaS vendor is a supplier.

A practical framework for FISMA supplier oversight

The framework below maps the core SR controls, plus related acquisition and external service controls, to operating steps. It mirrors how SAFE TPRM structures the third-party lifecycle.

Before the steps, here is how the statute, the controls, and the evidence line up:

• FISMA program coverage of contractor systems (44 U.S.C. 3554(b)) maps to SR-3 and SA-9. Evidence: supplier-to-system links and the controls each external service provider is required to employ.
• Supply chain risk responsibilities (3554(a)(1)(B)(vi)) map to SR-1 and SR-2. Evidence: the approved policy and the plan for each system.
• Periodic testing, no less than annually (3554(b)(5)), maps to SR-6. Evidence: dated supplier assessments and review records.
• Incident detection, reporting, and response (3554(b)(7)) maps to SR-8. Evidence: notification terms in contracts and records of supplier notices received.
• Remedial action process (3554(b)(6)) maps to your plan of action and milestones. Evidence: supplier findings tracked to closure.

If you can produce those five evidence sets for every Tier 1 supplier on request, your Inspector General’s evaluation of the supply chain portion of your program becomes a records exercise instead of a scramble.

Step 1: Write the C-SCRM plan and policy (SR-1, SR-2)

SR-1 requires supply chain risk management policy and procedures. SR-2 requires a supply chain risk management plan covering the system’s development, acquisition, maintenance, and disposal. Keep the plan short enough to use. Define tiers, the evidence each tier requires, review cadence, and who accepts residual risk. NIST SP 800-161 Revision 1 gives the detailed C-SCRM practice guidance.

Step 2: Link suppliers to systems and tier them (SR-3)

SR-3 (Supply Chain Controls and Processes) asks you to establish processes to identify and address weaknesses in the supply chain for each system. In practice, that means a supplier record linked to each system, with the system’s FIPS 199 impact level, the data the supplier handles, and its access. Tier on that basis:

• Tier 1: operates or hosts a moderate- or high-impact system, has privileged access, or supplies a critical component or service. Full assessment, contract terms, continuous external monitoring.
• Tier 2: supports a system with limited access or limited data. Standard assessment and annual review.
• Tier 3: no system access, no sensitive data. Basic due diligence.

SAFE TPRM’s intake captures these attributes and produces an Intake Score for inherent risk, routing each supplier to the right assessment profile.

Step 3: Build security into acquisition (SR-5, SA-4, SA-9)

SR-5 (Acquisition Strategies, Tools, and Methods) and SA-4 (Acquisition Process) put security requirements into the acquisition itself. SA-9 (External System Services) requires that providers of external system services comply with organizational security requirements, and that you define and monitor the controls they employ. Write the evidence you will need later into the solicitation: authorization status for cloud services, control assessment results, vulnerability disclosure, incident notification, and the right to review.

Step 4: Assess and review suppliers (SR-6)

For Tier 1 and Tier 2 suppliers, assess against the controls relevant to the system and the service: access control, audit and accountability, configuration management, incident response, system and information integrity, and secure development for software suppliers. Request evidence rather than yes or no answers, and use a software supply chain questionnaire for software producers. Where the supplier provides an SBOM, record it against the system so SR-4 (Provenance) questions can be answered later without another request.

SAFE TPRM sends questionnaires through a vendor portal, and AI-assisted review extracts relevant information from SOC 2 reports, ISO certificates, and other supplier documents, suggests answers with citations, and flags where an answer conflicts with the evidence. Analysts approve the conclusions.

Step 5: Agree notification terms (SR-8)

Set contract terms for how quickly suppliers notify you of compromises, vulnerabilities in what they supply, and assessment results, and what the notice must contain. Align them with your own incident reporting obligations. A notice that arrives in three weeks with no detail does not help you decide within seven days whether a major incident has occurred, so specify the content as well as the timing: what was affected, when it was detected, what data and systems are involved, and what the supplier has done to contain it.

Step 6: Monitor continuously between reviews

Annual review leaves long gaps. For Tier 1 suppliers, watch the external signals. SAFE TPRM’s Outside-In continuous monitoring tracks internet-facing services, vulnerabilities matched to observed services, email security, credential exposure, and breach signals, and shows what changed and which findings drove the change. Material events can feed findings, issues, and reassessment workflows. Our guide to continuous vendor monitoring covers cadence and thresholds.

Step 7: Track remediation and plan disposal (SR-12)

Supplier findings become tracked issues with owners and due dates, which feeds your plan of action and milestones. At contract end, SR-12 (Component Disposal) and your offboarding process should confirm data return or destruction and access removal.

What breaks at scale?

A small agency with 60 suppliers behind 20 systems can run this framework in spreadsheets and the GRC tool. Cabinet-level departments and large components operate hundreds of systems with thousands of supplier relationships.

At 200 suppliers, the bottleneck is evidence collection. Analysts chase documents by email and reconcile them against system records by hand.

At 1,000 suppliers, review cadence slips. Tier 2 suppliers get a questionnaire every few years instead of annually. Nobody is watching external signals between reviews, so supplier incidents surface through the news or the supplier’s own disclosure, late.

At 5,000 suppliers, the mapping of suppliers to systems drifts out of date, the Inspector General’s evaluation finds gaps the program cannot explain, and reporting to the CIO is assembled by hand.

SAFE TPRM is built for that point. Intake standardizes entry and tiering. Assessments reuse prior responses and documents on reassessment. Outside-In monitoring runs continuously across the portfolio, and the Exposure Score gives a residual risk view separate from the Intake Score. Workflows automate reminders and routing, and humans approve material decisions. Kyriba streamlined the assessment of 300+ vendors in one week on SAFE.

What trade-offs will you face?

Standard attestation or risk-based validation?

OMB memorandum M-26-05 (23 January 2026), “Adopting a Risk-based Approach to Software and Hardware Security,” rescinded M-22-18 and M-23-16. Agencies are no longer required to collect the common Secure Software Development Attestation Form, though they may still use it, and may still require an SBOM in contracts. The memo leaves agency heads responsible for validating provider security through a risk-based approach. That shifts the burden from a uniform form to agency judgment. It gives you flexibility, and it means you need a defensible method. Tiering plus evidence plus monitoring is that method, and SAFE TPRM’s configurable questionnaire profiles let you vary the evidence by risk tier instead of sending every supplier the same form.

Authorization package or ongoing assurance?

A cloud authorization or an ATO package is a point-in-time decision with continuous monitoring obligations attached. Agencies often lean on the package and under-invest in independent signals. Use the package for depth and external monitoring for currency. SAFE TPRM resolves the either/or by bringing Outside-In changes into the supplier record alongside assessment evidence.

Deep review of few or light review of many?

Staff limits force the choice. Tiering decides who gets depth. Reducing per-review effort through evidence reuse and AI-assisted document review extends depth further down the tiers. Continuous monitoring tells you which Tier 2 suppliers need attention this year.

Why SAFE TPRM for FISMA supplier oversight?

We built SAFE TPRM because supplier programs were spending their time chasing documents while missing the changes that matter. FISMA and the SR family ask for both evidence and currency. Here is what the platform does today:

• Intake and tiering. Governed intake captures the system, data, access, and business context, and produces an Intake Score for inherent risk.
• Assessments and evidence. Questionnaires through a vendor portal, AI-assisted document review with cited suggestions and discrepancy flags, and reuse of prior responses and documents on reassessment.
• Outside-In continuous monitoring. Continuous monitoring of each supplier’s external cyber posture, with a view of what changed and why.
• Issues and remediation. Findings become assigned issues with action plans, exceptions, and status tracking through closure.
• Offboarding. Offboarding as a governed lifecycle state, with open issues and closure records retained.
• Reporting. Portfolio views through dashboards and reporting for program, CISO, and CIO audiences.

SAFE TPRM supports the evidence, assessment, monitoring, and reporting work behind FISMA supplier oversight. It does not grant an authorization, replace an authorizing official’s decision, or make an agency compliant. See SAFE TPRM in action, or schedule a demo.

Frequently Asked Questions

Does FISMA apply to federal contractors?

What is the NIST SP 800-53 SR family?

How often must agencies test supplier-operated systems under FISMA?

Do agencies still require the secure software development attestation form?

How does SAFE TPRM support SR-6 supplier assessments?

Is this guidance legal or compliance advice?

What should an agency keep on file for each critical supplier?