What practices should be included in supply chain risk management for utility software and hardware?

What practices should be included in supply chain risk management for utility software and hardware?

• A. Vendor risk assessments, security practices, SBOMs, update cadence, incident response collaboration, and contractual security requirements.
• B. Only pricing and lead times.
• C. No vendor involvement.
• D. Assume all vendors are trustworthy.

Answer: (A)

In supply chain risk management for utility software and hardware, the focus is on building visibility, governance, and coordinated security across all vendors. This means regularly performing vendor risk assessments to understand each supplier’s security posture, applying and verifying security practices across the supply chain, and maintaining software bill of materials (SBOMs) so you know exactly which components and open‑source elements are in use. An update cadence ensures patches and security fixes are applied promptly to reduce exposure to known vulnerabilities, while incident response collaboration with vendors enables quick detection, containment, and recovery when incidents occur. Finally, embedding security requirements in contracts sets clear expectations, audits, and consequences, reinforcing security throughout the relationship. Other options miss fundamental security needs: focusing only on pricing and lead times ignores risk; excluding vendor involvement eliminates necessary oversight; and assuming vendors are trustworthy is unsafe for critical infrastructure.

In supply chain risk management for utility software and hardware, the focus is on building visibility, governance, and coordinated security across all vendors. This means regularly performing vendor risk assessments to understand each supplier’s security posture, applying and verifying security practices across the supply chain, and maintaining software bill of materials (SBOMs) so you know exactly which components and open‑source elements are in use. An update cadence ensures patches and security fixes are applied promptly to reduce exposure to known vulnerabilities, while incident response collaboration with vendors enables quick detection, containment, and recovery when incidents occur. Finally, embedding security requirements in contracts sets clear expectations, audits, and consequences, reinforcing security throughout the relationship.

Other options miss fundamental security needs: focusing only on pricing and lead times ignores risk; excluding vendor involvement eliminates necessary oversight; and assuming vendors are trustworthy is unsafe for critical infrastructure.