Procurement is evaluating a high-risk vendor for a courts case-management platform. Which due-diligence artifacts are proportionate?
Select an answer to reveal the explanation.
Short Explanation
For something as sensitive as courts case management, "trust us" is not a control. Ask for attestations, solid questionnaire answers, and inventories of what's inside the software. Match the paperwork pile to the risk—high stakes, deeper look.
Full Explanation
High-risk vendors for courts case-management platforms warrant proportionate due diligence: security attestations (for example SOC 2, ISO, or government authorizations where applicable), detailed questionnaire responses, and SBOM-like component inventories that reveal third-party libraries and supply-chain exposure. Courts data is sensitive; procurement should demand evidence scaled to impact—not marketing gloss. Attestations and inventories support informed residual-risk acceptance and contract clauses for patching and breach notice.
A single marketing one-pager with no security content provides no assurance suitable for case management.
Verbal assurances from a salesperson with no evidence are unenforceable and unverifiable under incident pressure.
Only the vendor's office floor-plan diagram addresses physical layout, not application security, encryption, or dependency risk relevant to the platform decision.
Exam caveat: vendor due diligence intensity scales with risk; high-impact justice systems need attestations and component transparency. Operational check: score RFP security responses, require SBOMs or equivalent for software products, validate attestation scope covers the hosted service boundary, and involve InfoSec and court stakeholders before award.