A vendor claims the library catalog API is 'fully tested,' but cannot show which security suites or paths were exercised. What should the city demand?
Select an answer to reveal the explanation.
Short Explanation
“Fully tested” without a map is like saying the whole building was inspected while only checking the lobby. Ask for coverage analysis. Brand logos, deleting evidence, or a sales handshake do not prove completeness.
Full Explanation
Coverage analysis quantifies whether security test suites exercised meaningful controls, code paths, and interfaces. Marketing assertions of completeness are insufficient without measurable evidence. Destroying artifacts or substituting sales warranties undermines assurance and contradicts sound assessment practice for municipal systems.