Does your organization have a formal process to assess the authenticity and security posture of critical technology products and services before acquisition and deployment?

Pre-acquisition due diligence is what reviewers want to see, namely a formal process for assessing the authenticity and security posture of critical technology products before you acquire and deploy them. Such assessments should include verification of vendor credentials, security certifications, vulnerability testing results, and supply chain integrity to prevent the introduction of compromised or insecure components.

Evidence could include a documented vendor security assessment procedure, completed security questionnaires for recent technology acquisitions, records of security certification verification, or reports from third-party security assessments of products prior to purchase decisions.