Questions CISOs Must Ask to Help Alleviate Supply Chain Attacks