Don't forget to include supply chain attacks in your risk assessment.