- Where measures refer to critical or sensitive network component or functions, the identification of these components or functions should be based on and consistent with the high-level categorisation of asset sensitivity defined in the EU coordinated risk assessment report (see annex 2 of this toolbox and paragraph 2.21 of the EU coordinated risk assessment report). - Where measures refer to the risk profile of individual suppliers, the assessment of the risk profile should take into account the factors defined in the EU coordinated risk assessment 29 (see annex 2 of this toolbox and para 2.37 of the EU coordinated risk assessment report). 4.1. Measures and supporting actions Table 2- Toolbox measures and supporting actions The mitigating measures are grouped into two general categories: strategic and technical. 29 The EU coordinated risk assessment report identifies several risk factors for the assessment of a supplier’s risk profile, notably: the likelihood of the supplier being subject to interference from a non-EU country (this may be facilitated by, but not limited to, the presence of certain factors, which are also listed in the EU coordinated risk assessment report); the supplier’s ability to assure supply; and the overall quality of products and cybersecurity practices of the supplier, including the degree of control over its own supply chain and whether adequate prioritisation is given to security practices. 11