Similar Items: Process Theory of Supplier Cyber Risk Assessment