1. Where do supply chain risks come from? * Vendor’s poor information security practices Lack of funds Lack of interest from vendors Competitors seeking to disrupt supply chain