What it asks for. Processes and procedures should be defined and implemented to manage the information security risks that come with ICT products and services across the supply chain, including suppliers' own suppliers.
In practice. For ICT purchases the organisation sets security requirements that suppliers must pass down to their subcontractors, asks about component origin and support lifetime, and expects timely vulnerability information and patches. Critical components may be verified, for example through software bills of materials or supplier attestations. Changes in the supply chain, such as a supplier moving hosting or adding a subcontractor, are tracked. Evidence includes contract clauses, supplier assessments and records of how supply chain risks were assessed and accepted.
Common gaps. Most organisations only look at their direct suppliers and know little about the fourth parties behind them. Open source dependencies are often treated as outside the supply chain even though they ship inside critical products.