Threat Evaluation Working Group: Supplier, Products, and Services Threat Evaluation (To Include Impact Analysis and Mitigation), Version 3.0 [open pdf - 2MB]
From the Executive Summary: "This latest report from the Threat Evaluation Working Group adds the assessment of Products and Services to include impacts and mitigating controls to each of the Supplier Threat Scenarios provided in the original version released in February 2020, and later augmented with impacts and mitigating controls in October 2020. These additional sections are included in Appendix C, Threat Scenarios, of this report. The Working Group (WG) chose to include these updates as a standalone report to benefit the audience without the need to include numerous references to the original reports."
U.S. Cybersecurity and Infrastructure Security Agency: https://www.cisa.gov/