An elections office must understand not only the ballot-system integrator but also who builds firmware and hardware components upstream. Which third-party activity addresses that need?
Select an answer to reveal the explanation.
Short Explanation
Supply chain analysis looks past the storefront to the parts bin—who made the boards and firmware that end up in voting gear. Coffee invoices and curtain colors won't tell you if a critical chip comes from a risky source.
Full Explanation
Supply chain analysis examines upstream vendors, components, firmware, and dependencies that can introduce integrity, availability, or confidentiality risk into critical systems. For an elections office, understanding not only the ballot-system integrator but also who builds hardware and firmware upstream is supply chain analysis: it maps the parts and providers behind the voting equipment so hidden dependencies and high-risk sources can be managed. Monitoring only the office coffee-supplier invoices tracks an unrelated consumable vendor. Beverage procurement does not reveal firmware or hardware provenance for voting systems. Accepting every subcontractor without review because the prime vendor is local ignores upstream risk. Geographic proximity of the integrator does not validate component integrity or subcontractor security practices. Limiting assessment to the color of the voting booth curtains evaluates cosmetics, not supply chain integrity. Curtain color has no bearing on component sources or firmware trustworthiness. Exam caveat: When stems emphasize upstream builders of components and firmware beyond the prime integrator, the activity is supply chain analysis within third-party risk management. Operational check: Inventory critical voting-equipment components and firmware sources, assess high-risk suppliers, require transparency from the integrator on subcontractors, and monitor for component or vendor changes across election cycles.