In the supply chain, not necessarily. Any software that goes onto a classified information system is supposed to go through a security review and audit, though

In the supply chain, not necessarily. Any software that goes onto a classified information system is supposed to go through a security review and audit, though. Based on my first-hand experience with various DOD agencies, though, I don't think many of the people working the information security side of the house are as up-to-date on technology as they should be.