Rec. 2.a: The DoD OIG recommended that the Under Secretary of Defense for Acquisition and Sustainment update existing DoD acquisition policies or develop and implement new policy to require organizations to review and evaluate cybersecurity risks, including supply chain and counterintelligence risks, for high-risk commercial off-the-shelf items prior to purchase, regardless of purchase method.