Step 2: Review Software Procurement Policy

Order Instructions

Step 2: Review Software Procurement Policy

Upon completion of the software specific vulnerability assessment, conduct a review of the organization’s software procurement policies for software development methods.

Note that there is no submitted assignment for this step. Your review will be used in the submission for the following steps.

When the review is complete, move to the next step, where you will create a table or spreadsheet that lists recommended policies for software procurement that address certain questions or concerns.

Step 3: Create a Software Procurement Policy List

You’ve reviewed the organization’s policies for software development methods. Now it’s time to create a policy list for software procurement. The following are some sample questions to be included in a software procurement policy:

Does the vendor provide any cybersecurity certifications with the product?

Does the vendor provide access to the source code for the product? Are there other security issues in source code to be addressed?

What is the guaranteed frequency of security updates to be provided for the product?

What is the implementation process for software updates/upgrades?

What are additional questions or concerns that should be included in the procurement process? Create a table or spreadsheet that lists recommended policies to properly address these questions or concerns.

Use the Procurement Policy Template to list the cybersecurity implications related to procurement and supply chain risk management and submit your results for feedback.