The "supply chain risk" option is to remove that company from the supply chain all together. The 'risk' is because the company is compromised by a foreign entity.

It is not about disciplining them to get better.

1. So one option is about forcing them to produce something. You must build this for us.

2 The other option is saying they are compromised so stop using them all together. We will not use what you build for us at all because we don't trust it.

So . Contradictory.