Zero Security Theatre
Evidence library
These sources support or challenge the work. Each note says what the source can establish, and contrary evidence stays in the library.
Standard
NIST SP 800-161 revision 1, supply chain risk management
Third-party practice guidance. The gap this area studies is between its practices and the tested escalation path.
Advisory
CISA Secure by Design
Places responsibility for safe defaults with the supplier, which is the vendor-side form of this area's design argument.
Used by Vendor and supply-chain resilience, Human error without human blame