Facilities wants to buy a new badge access system. What asset-management step should happen in acquisition?
Select an answer to reveal the explanation.
Short Explanation
Before the city writes a check for a new badge system, security should review what it must do—and refuse to do. Lowest-bidder speed without requirements is how you inherit weak doors and weaker software.
Full Explanation
Acquiring a new municipal badge and physical-access system is an asset and supply-chain decision with cyber consequences: readers, controllers, directories, and integrations become part of the attack surface. Requiring a security review against documented requirements before procurement forces vendors to address authentication, encryption, patch support, logging, and integration boundaries while the city still has leverage. Buying first and hoping later is how insecure defaults and weak cloud connectors become multi-year liabilities. Purchasing immediately from the lowest bidder with no security requirements review optimizes price while ignoring controls the system must meet. Skipping vendor questionnaires because physical badges supposedly have no cyber impact ignores that modern badge systems are networked computers. Installing first and inventing security requirements only after a breach reverses the acquisition lifecycle and leaves remediation as emergency change. Exam caveat: asset management includes security requirements during acquisition—not only inventory after gear arrives. Operational check: publish mandatory security requirements for badge RFPs, score vendor responses, and withhold purchase approval until gaps are accepted formally or remediated in contract language.