On July 8, 2026, NIST published SP 1326, a quick-start guide for cybersecurity supply chain due diligence — the research you do on a supplier before you buy. It defines five research categories: FOCI (foreign ownership, control, or influence), provenance, resilience, foundational cyber practices, and supply chain tiers. It is written for federal practitioners, not for you — which is exactly why it is worth reading. It tells you how federal buyers and primes research you, and it hands you a free, credible method to research your own vendors.
NIST SP 1326, Cybersecurity Supply Chain Risk Management: Due Diligence Assessment Quick-Start Guide, is a 21-page supplement to SP 800-161 Rev 1. NIST defines due diligence as "the investigative process of researching and verifying all available, pertinent information about a given supplier or product so that informed decisions can be made" — and frames it as the minimum reasonable research an acquirer should conduct, prioritized by criticality, before any deeper supplier review.
So why should a 12-person machine shop with a DoD contract care? Because you sit on both sides of this process:
This guide covers the research method. It pairs with the prohibition-screening rules — Section 889, FASCSA orders, TAA, the 1260H list — which are a different question. Screening asks "did this vendor trip a legal prohibition?" Due diligence asks "what do I actually know about this company?" A vendor can pass every list and still be a bad idea.
NIST's first move is to check the exclusion sources before spending effort on research — a hit here can end the inquiry immediately. SP 1326 names three:
Then NIST builds a traceable company baseline from public records: legal name, public/private status, incorporation date and location, headquarters address, office locations, employee count, DUNS and Unique Entity Identifier, ticker symbol, for-profit status, website. Dull, and the point. You cannot assess a company you have not first pinned down — and a supplier whose basic details are hard to establish is itself a finding.
NIST adds two optional layers: contracting data (number of contracts and dollars obligated in a date range, which agencies, whether their products appear in subcontracts) and security clearance questions (NISP participation, facility clearance level, highest employee clearance).
Foreign Ownership, Control, or Influence means significant ties to governments or government-controlled interests outside the focal country that have the power to affect the company's management or operations. NIST breaks it into three:
The questions NIST suggests: Does the company have foreign ownership, investment, or headquarters? Is a foreign merger or acquisition pending? Which SCRM-relevant leaders have foreign government ties? Is the company subject to foreign laws compelling cooperation with security services?
Critically, NIST does not hand you a country list or a risk threshold. Those are organization-defined parameters — you decide which countries are low, moderate, or high risk, how much foreign exposure you tolerate in a critical supplier, and whether a FOCI finding can be mitigated. For calibrating those levels, NIST points to the methodology in SP 800-30.
Provenance is the chronology of origin, development, ownership, location, and changes to a system or component — the definition tracks control SR-4 in SP 800-53 Rev 5. Worth internalizing: per SR-4, pedigree is provenance validated with evidence. Provenance is the claim; pedigree is the proof.
NIST splits it into supplier operational locations — R&D labs and where key source-code developers sit, manufacturing and fabrication, assembly, testing and QC, warehousing (physical and virtual data servers), and shipping and logistics nodes — and product-specific locations, which for hardware means country-level manufacturing or assembly, and for software means open-source and third-party code alongside proprietary development.
On SBOMs, NIST is specific: they should use NTIA-supported formats satisfying the EO 14028 minimum elements, and should be digitally signed with a verifiable, trusted key. An unsigned SBOM is an assertion, not evidence.
Resilience covers information affecting a supplier's ability to meet contractual obligations — reliability, regulatory compliance, and counterfeits in the market. This is the category small contractors most often skip, and the one that most often bites, because it is largely business risk wearing a cybersecurity label.
Organizational concerns NIST lists: financial distress (bankruptcy, credit insolvency, significant debt, risky investments); legal difficulties, especially litigation touching product stability, and industrial theft or espionage; turnover in key executive positions; regulatory violations including export controls, ITAR, and the Foreign Corrupt Practices Act; known associations with criminal or terrorist elements; data breaches including ransomware; conflict materials or forced labor; and environmental instability where they operate.
Product concerns: customer reports of poor performance, known counterfeiting or unauthorized white-labeling, and patterns of willful negligence or intentionally malicious practices that degrade trust.
NIST also gives you the calibration questions that keep this from becoming a witch hunt — how old is the information, how often has it happened, how severe was it, and what mitigations has the supplier since put in place? A breach five years ago followed by a real remediation program is a different finding than a breach last quarter met with silence.
NIST splits this into the supplier's own security posture and the security of what they build.
Part 1 — the supplier's IT. System compromises (malware, server and botnet compromise, spam propagation), user behavior (credentials exposed in third-party breaches, insecure file sharing), and security posture (unnecessary open ports, patching cadence, mobile app security, endpoint and configuration security, obsolete software versions, ransomware susceptibility). For data breaches specifically, NIST asks: how long ago, what was the severity and impact, did it affect confidentiality, integrity, or availability of their products or data, and what did they do about it?
Part 2 — the products. Unpatched CVEs, product lifespan and end-of-life status, and update frequency. Where an SBOM exists, NIST describes analytics worth running: who contributed code to each subcomponent and can it be validated cryptographically; sole-source committers (dependencies maintained by one person or a handful); dependency prioritization by criticality; community support and maintenance frequency; subcomponent end-of-life and age; the ratio of known to unknown subcomponents; and known unpatched or exploited CVEs in dependencies.
NIST is careful here, and so are we: having an SBOM does not mean software is secure. It means a tailored risk assessment becomes possible.
For research sources, NIST names several open-source and free tools — DNSChecker and Robtex for domain metadata, Shodan for internet-facing footprint, HackerTarget for DNS and network checks, VirusTotal for malware analysis, and Qualys SSL Labs or Mozilla Observatory for TLS configuration. NIST explicitly states that naming these does not imply endorsement or that they are the best available, and we'll repeat that disclaimer rather than dress it up as a recommended toolkit.
Suppliers are organized by their distance from the end user — first-tier suppliers deliver directly to you, second-tier suppliers deliver to them, and so on down. NIST is honest about the economics: going deeper increases visibility and understanding, but difficulty and cost increase exponentially.
The structural insight is that the further out you go, the larger the supplier portfolio becomes, and the higher the odds that someone in it appears on an exclusion list, watchlist, or noncompliance list. That is a statistical property of scale, not necessarily evidence of a bad supply chain — a distinction worth holding onto before you panic at a third-tier hit.
The questions NIST poses are ones most small shops have never asked: do multiple of your direct suppliers all depend on the same sub-tier supplier (a concentration risk that looks like diversity)? Does sole-sourcing to a trusted entity actually mitigate concerns about a problematic supplier deeper down? How do you balance limited supplier diversity against the higher likelihood of watchlisted entities in a broad sub-tier portfolio? For identifying which components deserve this depth of scrutiny at all, NIST points to NIST IR 8179, the Criticality Analysis Process Model.
NIST draws a clean line. Basic due diligence is desktop research using publicly available information. Enhanced due diligence adds commercial datasets, proprietary sources, and supply chain illumination tools — the AI-driven analytics platforms that map supplier relationships at depth.
For a small contractor, the important sentence in the entire publication may be this one: organizations determine the level of due diligence based on available resources and acquisition criticality. Basic due diligence on publicly available information is a legitimate, NIST-sanctioned answer. You are not failing a standard by not owning an illumination platform. You would be failing one by doing nothing and calling it trust.
NIST closes with three practice steps. Translated for a shop without a C-SCRM office:
Where this fits in the larger picture: per SP 1326, a due diligence assessment is a precursor to the SR-6 supplier review and often forms the threat and vulnerability foundation of the more robust RA-3(1) supply chain risk assessment. Due diligence is the research step — first, cheapest, and the one that makes everything after it possible. You can see how SR-6 and RA-3(1) map against what your contract actually requires in our 800-171 / 800-53 / CMMC crosswalk.
Due diligence tells you what a vendor is. Screening tells you whether they are barred. You want both, and the screening half is faster — six official lists, about fifteen minutes, before any purchase.
NIST's three closing recommendations, built and ready to fill in: a five-category report form, a levels-of-concern sheet to complete before you research, and a vendor register with review dates. Five tabs, one file, yours to keep.
Not as a requirement. It is guidance written for federal C-SCRM practitioners and program management offices — the people assessing suppliers, not the suppliers themselves. No assessor grades you against it and it is not a contract clause. It matters for two other reasons: it is the method federal buyers and primes use to research you, and it is a free, credible framework you can borrow to vet your own vendors.
Foreign Ownership, Control, or Influence (FOCI); Provenance; Resilience; Foundational Cyber Practices; and Supply Chain Tiers. NIST derives them from the baseline risk factors in SP 800-161 Rev 1, Appendix E, Table 28.
Basic is desktop research using publicly available information. Enhanced adds commercial datasets, proprietary sources, and supply chain illumination tools. NIST says organizations choose the level based on available resources and acquisition criticality — so basic due diligence is a legitimate answer for a small shop, not a shortcut.
No. A due diligence assessment is a precursor to the SR-6 supplier review, and often forms the threat and vulnerability foundation of the more robust RA-3(1) supply chain risk assessment. Due diligence is the research step that comes first.
No. CMMC Level 2 is built on NIST SP 800-171 Rev 2, which has no dedicated supply chain (SR) family, so there is no scored supply-chain control an assessor grades today. Your supply-chain obligations come from Section 889, FASCSA orders, and DFARS flow-downs instead. Rev 3 adds an SR family, so this changes if and when CMMC transitions to Rev 3.
No. Those are what NIST classifies as enhanced due diligence, and the guidance explicitly scales expected rigor to available resources and how critical the acquisition is. Start with the publicly available sources and a written record.