[Maya Chen]

Security questionnaires often focus on production controls and say little about how the software is built. What evidence is actually useful?

[Priya Shah]

Accepted answer

Ask how the vendor protects source code and build systems, reviews changes, manages dependencies, tests security, handles vulnerabilities, separates environments, signs releases, and remediates defects. Match the depth of evidence to product risk and avoid demanding sensitive artifacts that the buyer cannot protect or assess. Contract for material remediation and change notice. NIST SP 800-218 provides a common secure software development framework.

[Ethan Cole]

Community reply

What should a small buyer do if it receives secure development documents but has no specialist to assess them?

[Author]

Posts