Which statement best describes vendor risk assessment for utility software and hardware?

Which statement best describes vendor risk assessment for utility software and hardware?

• A. Evaluate only price and delivery speed.
• B. Require contractual security requirements and periodic third-party audits.
• C. Assess vendors for security practices, software provenance, code signing, SBOMs, update cadence, and incident response collaboration.
• D. Ignore supply chain risk management.

Answer: (C)

Vendor risk assessment for utility software and hardware should focus on security and resilience across the supply chain. The best approach requires asking for and verifying how a supplier protects the software and hardware throughout its lifecycle. This includes checking software provenance to know exactly where components come from, ensuring code signing to verify authenticity and integrity, and obtaining a Software Bill of Materials so you can see every component and component-level risks. It also means confirming a clear update cadence to receive timely patches, and establishing strong collaboration on incident response so your teams can coordinate quickly if a security event occurs. Together, these elements provide visibility, trust, and coordinated risk management essential for critical infrastructure. Other options miss important pieces. Focusing only on price and delivery speed ignores security and resilience. Relying solely on contractual security requirements and third-party audits helps, but without proven provenance, code signing, SBOMs, and ongoing incident-response collaboration, gaps can remain. Ignoring supply chain risk management is not acceptable for utilities given the need to protect critical operations.

Vendor risk assessment for utility software and hardware should focus on security and resilience across the supply chain. The best approach requires asking for and verifying how a supplier protects the software and hardware throughout its lifecycle. This includes checking software provenance to know exactly where components come from, ensuring code signing to verify authenticity and integrity, and obtaining a Software Bill of Materials so you can see every component and component-level risks. It also means confirming a clear update cadence to receive timely patches, and establishing strong collaboration on incident response so your teams can coordinate quickly if a security event occurs. Together, these elements provide visibility, trust, and coordinated risk management essential for critical infrastructure.

Other options miss important pieces. Focusing only on price and delivery speed ignores security and resilience. Relying solely on contractual security requirements and third-party audits helps, but without proven provenance, code signing, SBOMs, and ongoing incident-response collaboration, gaps can remain. Ignoring supply chain risk management is not acceptable for utilities given the need to protect critical operations.