That’s literally what they’re doing. That’s what supply chain risk means.
They don’t buy the product, and the product can’t be used in the things they do buy.
They don’t buy the product, and the product can’t be used in the things they do buy.
These blanket rules are very typical in large organizations.
Not to mention, they simultaneously said it was a supply chain risk and that it would continue to be used by agencies that were already using it in a critical capacity. Which makes absolutely no sense.