The company formally tracks the software components it uses to manage risks from third-party code
Inventorying the software components the company builds with or depends on, and managing their third-party risk, supports A.5.21's ICT supply chain requirement, which also extends to services, hardware and suppliers' own sub-processors.
This policy control states that software components the company depends on are inventoried to manage third-party risk, matching A.5.9's asset inventory scope.