Guidance describes practical steps to help organisations assess cyber security in their supply chains.