Which practice provides formal visibility into software components used by suppliers to manage supply chain security risk?

Which practice provides formal visibility into software components used by suppliers to manage supply chain security risk?

• A. Data minimization
• B. Incident reporting
• C. SBOMs
• D. Access controls

Answer: (C)

Providing formal visibility into software components used by suppliers hinges on having a complete, structured inventory of every library, package, and module included in the software, along with versions and how they relate to one another. An SBOM, or Software Bill of Materials, is exactly that: a standardized list that names all components and their metadata. With this inventory, you can see what pieces are in your products, identify which components have known vulnerabilities, and understand which suppliers or products are affected. This makes it possible to assess supply chain risk, plan remediation, and verify that security controls align with the actual components in use. Other options address different security concerns. Data minimization is about limiting what data you collect, incident reporting focuses on communicating about security events after they occur, and access controls govern who can reach systems or data. While important, none of these provide the formal, itemized view of software components that SBOMs deliver for managing supply chain risk.

Providing formal visibility into software components used by suppliers hinges on having a complete, structured inventory of every library, package, and module included in the software, along with versions and how they relate to one another. An SBOM, or Software Bill of Materials, is exactly that: a standardized list that names all components and their metadata. With this inventory, you can see what pieces are in your products, identify which components have known vulnerabilities, and understand which suppliers or products are affected. This makes it possible to assess supply chain risk, plan remediation, and verify that security controls align with the actual components in use.

Other options address different security concerns. Data minimization is about limiting what data you collect, incident reporting focuses on communicating about security events after they occur, and access controls govern who can reach systems or data. While important, none of these provide the formal, itemized view of software components that SBOMs deliver for managing supply chain risk.