An enterprise financial organization is auditing its software vendors' supply chain risk management practices. The security team needs to verify code integrity and ensure compromised third-party open-source dependencies are identified before being integrated into internal build pipelines. Which of the following technical controls or artifacts should the organization require vendors to provide? (Select TWO.)
- A comprehensive Software Bill of Materials (SBOM) identifying all third-party libraries and dependency versionsAnswer
- Cryptographically signed code attestations and digital signatures for all software packages and release binariesAnswer
- CA standard Non-Disclosure Agreement (NDA) outlining confidentiality obligations regarding proprietary algorithms
- DA Service Level Agreement (SLA) establishing guaranteed uptime and system response time benchmarks
- EAn annual perimeter firewall penetration testing summary report covering external network boundaries
Answer
The organization should require a Software Bill of Materials (SBOM) and cryptographically signed code attestations.
Requiring a Software Bill of Materials (SBOM) allows organizations to maintain complete visibility into nested third-party dependencies and quickly evaluate them against known vulnerability databases. Pairing this with cryptographically signed code attestations ensures that binaries and packages have not been altered or tampered with by unauthorized parties during build or transit.
Step-by-Step Solution
Key Concept
Supply Chain Security Verification and Software Provenance