Secure by Demand: Going Beyond Questionnaires & Software Bills of Materials

Enterprise buyers need direct, verifiable evidence of software security. Here's why your organization needs to trust, but verify.

Joe Coletta

CISA’s Secure by Demand guidance provides a list of questions that enterprise software buyers should ask software producers to evaluate their security practices prior to, during and after procurement. It’s a good idea in principle as every organization needs to be asking the questions presented in “Secure by Demand Guide: How Software Customers Can Drive a Secure Technology Ecosystem.”

The question lies in how you get answers. Questionnaires and SBOMs provide certain information, but don’t provide enough to be able to truly assess the risk of the product that you're buying. Enterprise buyers need direct, verifiable evidence of software security. Here's why you need to trust, but verify.

Get White Paper: Go Beyond the SBOM to Bring Control to Third-Party Software Risk

Secure by Demand: Key Subject Areas

The questions CISA suggests software vendors answer fall into six subject areas:

General questions: Has the vendor taken CISA’s Secure by Design pledge, and how do they manage security patches for their customers?
Authentication: How does the vendor support secure authentication such as single sign-on (SSO), MFA, passkeys, and password management?
Eliminating vulnerability classes: Does the vendor systematically address software vulnerabilities across its products, and does it have a roadmap to fix known security defects?
Evidence of intrusions: Does the vendor, namely cloud service and SaaS providers, provide security logs to their customers to provide evidence of possible intrusions?
Software supply chain security: How does the vendor maintain and share provenance data of third-party dependencies (e.g. software bills of materials, or SBOMs) and have processes to govern its use of, and contributions to, open source software components?
Vulnerability disclosure: Does the vendor have a vulnerability disclosure program (VDP) to demonstrate transparency and timeliness in vulnerability reporting for both on-premises and cloud products?

Secure by Demand: A Good First Step — But Certainly Not the Last

Tags:Products & Technology

Secure by Demand: Key Subject Areas

The questions CISA suggests software vendors answer fall into six subject areas:

General questions: Has the vendor taken CISA’s Secure by Design pledge, and how do they manage security patches for their customers?

Authentication: How does the vendor support secure authentication such as single sign-on (SSO), MFA, passkeys, and password management?

Eliminating vulnerability classes: Does the vendor systematically address software vulnerabilities across its products, and does it have a roadmap to fix known security defects?

Evidence of intrusions: Does the vendor, namely cloud service and SaaS providers, provide security logs to their customers to provide evidence of possible intrusions?

Software supply chain security: How does the vendor maintain and share provenance data of third-party dependencies (e.g. software bills of materials, or SBOMs) and have processes to govern its use of, and contributions to, open source software components?

Vulnerability disclosure: Does the vendor have a vulnerability disclosure program (VDP) to demonstrate transparency and timeliness in vulnerability reporting for both on-premises and cloud products?