How NIST CSF 2.0 and C-SCRM help manage software supply chain risk

The U.S. National Institute of Standards and Technology (NIST) released the first version of its Cybersecurity Framework (PDF) in 2014. It was originally designed for use by the U.S.'s critical infrastructure sectors to help them better manage cybersecurity threats. As for the enterprises and small businesses that make up the bulk of the U.S. economy? NIST's CSF had less to say about their needs.