1. Figure 1. Current Threat Landscape Sentiment From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 1

2. Figure 2. Security Incidents Organizations Have Experienced Over the Past 24 Months From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 2

3. Figure 3. Consequences of the Security Incidents Organizations Have Experienced Over the Past 24 Months From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 3

4. Figure 4. Primary Drivers of Organization’s Cybersecurity Strategy From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 4

5. Figure 5. Cyber Supply Chain Security Sentiment From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 5

6. Figure 6. Why Organizations Believe Cyber Supply Chain Security Is Becoming More Difficult From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 6

7. Figure 7. Most Important Security Considerations During Product Evaluation and Purchasing Processes From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 7

8. Figure 8. Audits of Strategic Suppliers From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 8

9. Figure 9. Internal Groups Responsible for IT Vendor Security Audit Processes From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 9

10. Figure 10. Mechanisms Used to Conduct IT Vendor Security Audits From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 10

11. Figure 11. Current IT Vendor Security Audit Process From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 11

12. Figure 12. Measurement of IT Vendor Security Audits From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 12

13. Figure 13. Respondents Rate IT Vendors’ Commitment to/Communications about Internal Security Processes and Procedures From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 13

14. Figure 14. Confidence Level in Organization’s Knowledge of the Purchasing Origin of Hardware and Software From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 14

15. Figure 15. Use of Suspect Vendors From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 15

16. Figure 16. Internal Software Development From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 16

17. Figure 17. Confidence Level in Security of Internally Developed Software From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 17

18. Figure 18. Security Incidents Related to the Compromise of Internally Developed Software From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 18

19. Figure 19. Security Activities Included as Part of the Software Development Process From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 19

20. Figure 20. Secure Software Development Initiatives From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 20

21. Figure 21. Why Organizations Chose to Establish a Secure Software Development Program From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 21

22. Figure 22. Plans to Include Security Activities as Part of the Software Development Process From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 22

23. Figure 23. Outsourcing of Software Maintenance or Development Activities From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 23

24. Figure 24. Security Safeguards Mandated of Service Providers From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 24

25. Figure 25. Sharing of IT Services or Business Applications with Third Parties From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 25

26. Figure 26. Approximate Number of External Third Parties with which Respondent Organizations Share IT Services or Business Applications From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 26

27. Figure 27. Security Controls Partners Require When Receiving IT Services or Business Applications from Critical Infrastructure Organizations From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 27

28. Figure 28. Security Controls Critical Infrastructure Organizations Require When Using IT Services or Business Applications from Third Parties From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 28

29. Figure 29. Groups Responsible for Security Policies and Safeguards for Interaction with Third Parties From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 29

30. Figure 30. Establishment of Security Policies and Safeguards for Interaction with Third Parties From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 30

31. Figure 31. Respondents’ Opinion of the U.S. Federal Government’s Cybersecurity Strategy From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 31

32. Figure 32. Role of the U.S. Federal Government with Regard to Cybersecurity From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 32

33. Figure 33. Suggested Actions for the U.S. Federal Government with Regard to Cybersecurity From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 33

34. Figure 34. Survey Respondents by Current Job Function From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 34

35. Figure 35. Survey Respondents by Number of Employees From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 35

36. Figure 36. Survey Respondents by Industry From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 36

37. Figure 37. Survey Respondents by Annual Revenue From: ESG Research Report: Cyber Supply Chain Security Revisited. Source: Enterprise Strategy Group, 2015. Created for, Guest. IP Address: 178.63.87.137 © 2015 Enterprise Strategy Group, Inc. All Rights Reserved 37