How do you assess the security of a supply chain and third-party risk within ISSAP?

• A. Evaluate supplier security practices, contractual controls, SBOM, vulnerability management, and ongoing monitoring of third parties for risk exposure.
• B. Only review price and delivery times; no security considerations.
• C. Requires no due diligence for cloud vendors.
• D. Focus solely on end-user device security.

Answer: (B)

Assessing supply chain and third-party risk in ISSAP means implementing a program that covers people, processes, and technology across every vendor. This starts with evaluating supplier security practices—what controls they have in place, how they manage development, patching, vulnerability remediation, and incident response. It also relies on contractual controls that codify security requirements, audit rights, data protection obligations, and breach notification timelines, ensuring vendors are contractually obliged to maintain a baseline security posture. A Software Bill of Materials (SBOM) is essential to know exactly what components and open-source elements are in use, enabling precise vulnerability identification and management. Coupled with a formal vulnerability-management process, this ensures vendors must address findings and provide timely remediation evidence. Ongoing monitoring of third parties for risk exposure is critical, using continuous assessments, risk ratings, and alerts for changes in vendor posture or new threats. This holistic, continuous approach aligns with ISSAP practices for supply chain risk management and cloud vendor diligence. Focusing only on price and delivery, skipping security considerations, ignoring due diligence for cloud providers, or concentrating solely on end-user devices leaves significant risk unmanaged.