Cybersecurity Supply Chain Risk Management (C-SCRM) (Self-Paced)

Self-paced online training with expert support

Visibility usually stops at the first tier of suppliers — and the risk does not. Learn to work out which suppliers genuinely matter, get real security terms into an agreement before it is signed, and check afterward that the supplier delivered them.

$1,049 12 clock hours Live Support Start anytime

This course includes

  • 12 hours of project-based training from experts
  • Answers from real instructors
  • Retake for free within 1 year
  • Access to class recordings (30 days)
  • Verified digital certificate of completion

This is the self-paced version. For live instruction, enroll in Cybersecurity Supply Chain Risk Management (C-SCRM).

A complete self-paced treatment of cybersecurity supply chain risk management, following the structure of NIST SP 800-161r1 closely. The route runs from foundations and threat sources through criticality analysis, folding C-SCRM into enterprise risk management, standing up the program, assessing suppliers, setting procurement requirements, applying controls, handling the software supply chain, monitoring, and managing the supplier relationship to its end — finishing in an applied workshop. Two deliberate choices give the course more depth than its length suggests. Criticality analysis comes before any supplier assessment, because treating every supplier as equally important burns the budget long before you reach the handful that could halt operations. And the three-level model keeps organization, mission and business process, and system-level C-SCRM distinct — the exact distinction practitioners tend to blur, and then cannot untangle in front of leadership.

What sets this course apart is that its currency is checkable, not a marketing claim. Supply chain regulation has been rewritten again and again since early 2025, and the material here reflects the position as of August 2026. Take the clearest case: the secure-software attestation mandate was rescinded in January 2026 and is now left to each organization to decide, so any course still presenting attestation as compulsory is teaching a regime that has already ended. The last module therefore teaches the skill itself — how to establish for yourself whether a clause, prohibition or deadline is still in force. On software, the course goes well beyond defining SBOM: SPDX and CycloneDX formats, VEX as the artifact that tells you whether a listed vulnerability is genuinely exploitable, build-integrity levels, and tooling for artifact signing and project health. The NIST core is vendor-neutral and drops straight into any third-party risk program, with the procurement-specific content running as a clearly marked thread instead of being spread through everything.

Read more

This course has a prerequisite

Foundational cybersecurity knowledge. Familiarity with procurement or third-party risk processes is helpful but not required.

Yelp Facebook LinkedIn YouTube Twitter Instagram