Does your organization have a formal process to verify the authenticity, integrity, and security of critical products before acquisition and deployment?

Pre-acquisition assurance is the subject: this item asks whether you have a formal process to verify the authenticity, integrity, and security of critical products before you deploy them.

This includes verifying the legitimacy of the vendor, checking for tampering during delivery, and evaluating security vulnerabilities or weaknesses in the products themselves.

These checks help prevent supply chain attacks, counterfeit products, and the introduction of compromised software or hardware into your systems.

Evidence could include a documented product security assessment procedure, vendor verification checklists, digital signature verification processes, or reports from security testing performed on critical products before deployment.