CISA's updated standard asks vendors for every component in their software, including borrowed code. Two researchers say ...