Which two acquisition routes does NIST say supply chain risk must also be addressed for, beyond formal procurement? Choose two.

Answer: B. Open source software
C. Repurposing an existing product to satisfy a new need

SP 800-161r1 notes goods and services arrive by routes that bypass procurement altogether — open source, an in-house shared service provider, or an existing product turned to a new purpose.

Source: NIST SP 800-161 Rev. 1 (NIST) — Sec. 3.1 C-SCRM in Acquisition