Examkin

Question

Difficulty: MediumThird-Party Risk Management and Supply Chain Oversight

An organization's security team is enhancing its software supply chain risk management practices for newly acquired third-party applications. To proactively verify that external vendor applications do not introduce known vulnerabilities from embedded open-source libraries, which of the following artifacts should the organization require vendors to provide?

  1. A Software Bill of Materials (SBOM)Answer
  2. B
    A Business Impact Analysis (BIA)
  3. C
    An Interconnection Security Agreement (ISA)
  4. D
    A Service Level Agreement (SLA)

Answer

The organization should require vendors to provide a Software Bill of Materials (SBOM).
Requiring a Software Bill of Materials (SBOM) allows organizations to maintain continuous visibility into the component libraries and open-source software embedded within vendor-supplied applications. This inventory is critical for analyzing supply chain risks and reacting promptly when vulnerabilities are discovered in common upstream libraries.

Step-by-Step Solution

1
Identify the primary security concern in the scenario
The core requirement is identifying hidden vulnerabilities in third-party software and open-source libraries integrated into vendor products.
Supply chain security risks often stem from nested open-source dependencies contained within compiled or distributed software packages.
2
Evaluate the appropriate supply chain governance artifact
A Software Bill of Materials (SBOM) provides a complete nested inventory of code components, libraries, and modules.
Having an SBOM enables security teams to correlate identified component versions against known vulnerability databases (such as CVEs).

Key Concept

Software Bill of Materials (SBOM) in Supply Chain Security
Estimated Time:1m 15s
Rate this question

Topics

Third-Party Risk Management and Supply Chain Oversight

More questions from this topic