A software vendor will supply a component that runs inside a company's cloud application and processes customer personal data. Before the component is approved, which activity is most appropriate as part of software supply-chain management?
Select an answer to reveal the explanation.
Short Explanation
You wouldn't hand your house keys to a contractor without checking references and signing a contract. Same deal here: you assess the vendor's security practices and put the security and data-handling rules in writing before their code touches customer data. 'It's commercial, so it's safe' is the trap.
Full Explanation
Software supply-chain management treats suppliers as part of the organization's attack surface and its compliance posture. Before a third-party component that processes personal data is approved, the organization assesses the vendor: its secure development practices, vulnerability management and patching commitments, independent attestations or certifications, incident history, and its own sub-suppliers. The results feed a risk decision, and the requirements are fixed in the contract, covering security obligations, data handling and location, breach notification, right to audit, support and end-of-life terms. Assuming commercial software is secure because a vendor tested it relies on unverified claims; commercial products routinely contain vulnerabilities, and accountability for customer data remains with the company. Running the component in production on trial exposes real personal data to unassessed risk, and waiting for incidents means detection after harm has occurred. Demanding public release of proprietary source code is unrealistic, is not required to establish assurance, and would not in itself prove the code is secure. Exam caveat: ISO/IEC 27036 addresses information security in supplier relationships and is a reasonable reference for this process. Operational check: confirm the component has a completed vendor assessment on file, signed contractual security terms, a named internal owner and an entry in the software inventory.