Does your organization provide regular risk reporting to leadership regarding the authenticity and integrity of acquired components?

This question assesses whether your organization has a formal process to verify and report on the authenticity of components (hardware, software, services) acquired from third parties, and communicates these findings to leadership. Supply chain attacks often target organizations through compromised components, making verification and leadership awareness critical security controls. Evidence could include quarterly or monthly reports to leadership that document component verification activities, findings from integrity checks, summaries of vendor security assessments, or dashboards showing supply chain risk metrics with authenticity verification results.