Question

A financial services company is onboarding a third-party software vendor whose product will be integrated into a payment processing pipeline. The security architect wants to reduce supply-chain risk by ensuring the company can independently verify the components within the vendor's software, detect known vulnerabilities in embedded open-source libraries, and validate that delivered binaries match the vendor's build artifacts. Which combination of contractual and technical requirements BEST addresses these goals?

Accepted Answer

Require the vendor to provide a signed SBOM in a standardized format along with cryptographically signed artifacts and attestation of the build process

Answer

Require the vendor to complete an annual SOC 2 Type II audit and share the resulting attestation report with the security team

Answer

Require the vendor to carry cyber liability insurance sufficient to cover breach remediation costs and indemnify the company

Answer

Require the vendor to submit to an on-site penetration test of their production environment before each software release