Comment by bubblewand

I'm pretty sure you (and others) are trying to apply some kind of guess at the "supply chain risk" designation, but it means something specific.

Here's the term defined in an official context:

https://www.acquisition.gov/dfars/252.239-7018-supply-chain-....