In addressing supply chain security risk, which practice is standard?

• A. Vet vendors, require security requirements, monitor supply chain, include SBOMs, perform risk assessments.
• B. Only assess vendors after a breach.
• C. Rely solely on internal controls; supply chain is outside Annex F.
• D. Use a generic checklist with no SBOMs.

Answer: (A)

Addressing supply chain security risk requires a proactive, layered approach that covers who you work with, what security requirements they meet, how you monitor ongoing risk, and visibility into software components. Vetting vendors helps you select partners with strong security practices from the start. Requiring security requirements in contracts sets clear expectations and accountability. Ongoing monitoring keeps track of changes, incidents, and new threats in the supply chain. Including Software Bills of Materials (SBOMs) provides a transparent inventory of components and dependencies, so you can quickly identify vulnerable versions or risky licenses. Performing formal risk assessments helps prioritize mitigations based on potential impact and likelihood. Together, these practices create a comprehensive, proactive defense.

This approach is preferable to waiting for a breach, relying only on internal controls, or using a generic checklist without SBOMs, all of which leave gaps in visibility and proactive protection.