Consider further references

[ioggstream]

Further references to be considered

• [ ] NIST SP 800-63-3
• [ ] https://csrc.nist.gov/projects/cyber-supply-chain-risk-management

[wurstbrot]

To add references is a commitment for further actions, also. But in case a reference is not there for new actions, I think it is acceptable to have new actions without a specific reference, e.g. to NIST SP 800 63 3.