ENISA Threat Landscape 2016 report: cyber-threats becoming top priority
https://www.enisa.europa.eu/news/enisa-news/enisa-threat-landscape-2016-report-cyber-threats-becoming-top-priority/

If IT security boils down to that of the weakest “link”, then what is the sense arbitrarily limiting the scope of the annual EU ENISA Cyber Threat Reports by exclude some “links” such as the entire supply chain. Why is that?!

US Defense Science Board said already in 2005: “Trust cannot be added to integrated circuits after fabrication”.

In the Thematic Landscape Hardware document, vulnerabilities introduced during the fabrication and supply chain are out of scope. They say: “According to the scoping performed in Section 1.1, supply chain security aspects which are relevant for invasive/integrated modification of hardware was not in scope of the good practice research.”