Supply-chain risk
CISA ICT supply-chain guidance needs acquisition evidence—not a supplier score
CISA’s small-business fact sheet frames ICT supply-chain risk as work across products, services, suppliers, and acquisition. A questionnaire score cannot establish the risk, integrity, availability, or suitability of a particular technology supply chain.