Examkin

Question

Difficulty: Very hardThird-Party Risk Management and Supply Chain Oversight

An enterprise financial service provider relies on a third-party software-as-a-service (SaaS) platform to process sensitive customer data. During a recent audit, the security team discovered that while the SaaS vendor maintains a clean SOC 2 Type II report, the vendor's software pipeline dynamically pulls unverified sub-dependencies from open-source repositories at build time, exposing the enterprise to potential downstream software supply chain compromises. Which of the following technical controls should the enterprise security team require from the vendor to continuously validate component integrity and mitigate this software supply chain risk?

  1. Mandate the submission of machine-readable Software Bill of Materials (SBOM) artifacts alongside cryptographically signed build attestations for each release.Answer
  2. B
    Require an updated Interconnection Security Agreement (ISA) mandating mutual transport layer encryption and dedicated IP whitelisting for all API traffic.
  3. C
    Enforce quarterly SOC 2 Type II audit attestations covering the Availability and Confidentiality trust services criteria with zero reported exceptions.
  4. D
    Incorporate a Service Level Agreement (SLA) clause specifying stringent financial penalties and immediate notification triggers for zero-day supply chain breaches.

Answer

Mandate the submission of machine-readable Software Bill of Materials (SBOM) artifacts alongside cryptographically signed build attestations for each release.
Requiring a machine-readable Software Bill of Materials (SBOM) and cryptographically signed build attestations directly mitigates software supply chain risk. An SBOM discloses all nested third-party libraries, allowing the enterprise to continuously analyze software components against vulnerability databases. Cryptographic attestations verify that the code built matches the audited source code without tampered dependencies.

Step-by-Step Solution

1
Analyze the identified risk scenario
The core security vulnerability stems from unvalidated, dynamic open-source sub-dependencies within the vendor's build pipeline (software supply chain risk).
Point-in-time compliance reports and network-level security controls do not grant visibility into software component composition.
2
Evaluate third-party software supply chain risk mitigation controls
An SBOM explicitly details all direct and nested components, libraries, and modules, while signed build attestations verify code provenance and prevent unauthorized pipeline modifications.
Modern third-party risk oversight requires continuous, automated tracking of software dependencies to identify zero-day vulnerabilities in third-party code.
3
Differentiate technical supply chain controls from legal and network controls
Selecting SBOM ingestion and build attestation addresses component transparency directly at the software artifact level.
ISAs address network connectivity, SOC 2 reports provide periodic audit compliance, and SLAs enforce contractual liabilities.

Key Concept

Software Supply Chain Oversight and SBOM Verification
Rate this question

Topics

Third-Party Risk Management and Supply Chain Oversight

More questions from this topic