CSSLP: Supply Chain and Software Acquisition