Procurement is evaluating a high-risk vendor for a courts case-management platform. Which due-diligence artifacts are proportionate?
Select an answer to reveal the explanation.
Short Explanation
For something as sensitive as courts case management, "trust us" is not a control. Ask for attestations, solid questionnaire answers, and inventories of what's inside the software. Match the paperwork pile to the risk—high stakes, deeper look.
Full Explanation
Vendor assurance for acquired software commonly includes security questionnaires, independent attestations or certifications as applicable, and software bills of materials or equivalent component inventories. The depth of due diligence should be proportionate to data sensitivity and operational criticality. These artifacts support Domain 8 assessment of third-party software risk.