Supply chain issues are the current rage, but there hasn’t been much conversation about the obligation to protect against a misbehaving supplier. Is there an obligation to require that a vendor’s development and delivery environment be secure? Can organizations depend on that contractual obligation or is this a trust but verify situation? Is it possible to be found negligent because of too much trust?