Supply chain risk assessment and mitigation