Objective 4.2Medium11 min

Acquisition and Procurement

Security considerations when acquiring hardware and software including vendor assessment, supply chain security, and third-party risk management throughout the procurement lifecycle.

Understanding Acquisition and Procurement

Acquisition and procurement security ensures that hardware, software, and services are secure before they enter your environment. Supply chain attacks compromise products before delivery, making vendor assessment and secure procurement essential.

Key acquisition considerations:Vendor assessment — Evaluate security posture before purchase • Supply chain security — Protect against tampering in transit • Contract requirements — Define security obligations • Due diligence — Verify claims and certifications

The 2020 SolarWinds attack demonstrated supply chain risk at scale—attackers compromised the build process, inserting malware into legitimate software updates. Over 18,000 organizations installed the trojanized update, including government agencies and Fortune 500 companies.

What you buy becomes part of your security posture. Trust but verify.

Why This Matters for the Exam

Acquisition and procurement security is tested on SY0-701 because supply chain attacks are increasingly common. Questions cover vendor assessment, procurement controls, and supply chain risks.

Understanding procurement security helps with vendor management, risk assessment, and compliance requirements. A compromised vendor becomes your compromise.

The exam tests recognition of procurement risks and appropriate security controls.

Deep Dive

What Is Vendor Assessment?

Vendor assessment evaluates a supplier's security posture before establishing a business relationship.

Vendor Assessment Components:

ComponentPurpose
Security questionnaireAssess policies and controls
CertificationsVerify third-party validation
Audit reportsReview independent assessments
Penetration test resultsUnderstand vulnerabilities
Financial stabilityAssess business continuity

Assessment Methods:

MethodDescription
QuestionnaireWritten security questions
On-site auditPhysical inspection
Third-party auditSOC 2, ISO 27001
Penetration testTechnical assessment
Reference checkCustomer feedback

Vendor Risk Tiers:

Tier 1 - Critical:
- Access to sensitive data
- Critical infrastructure
- Annual on-site audit
- Quarterly reviews

Tier 2 - Significant:
- Business-critical services
- Limited data access
- Annual questionnaire
- Semi-annual reviews

Tier 3 - Standard:
- Commodity services
- No sensitive access
- Initial assessment
- Annual review

What Is Supply Chain Security?

Supply chain security protects products from tampering during manufacturing, shipping, and delivery.

Supply Chain Risks:

RiskExample
CounterfeitFake components with backdoors
TamperingModification during shipping
CompromiseMalware in build process
SubstitutionDifferent product than ordered
Insider threatMalicious employee at vendor

Supply Chain Controls:

ControlPurpose
Trusted suppliersVetted vendor list
Tamper-evident packagingDetect physical access
Chain of custodyTrack product handling
Hardware verificationValidate authenticity
Firmware validationCheck for modification

Hardware Supply Chain:

Risks at each stage:
Manufacturing → Component substitution
Shipping → Physical tampering
Storage → Access by unauthorized personnel
Delivery → Last-mile compromise

Controls:
- Authorized resellers only
- Tamper-evident seals
- Serial number verification
- Hardware attestation

What Should Procurement Contracts Include?

Security requirements must be contractually defined.

Contract Security Clauses:

ClausePurpose
Security requirementsDefine minimum standards
Right to auditAllow security assessments
Incident notificationRequire breach reporting
Data handlingSpecify data protection
TerminationAddress data return/destruction

Key Contract Elements:

Service Level Agreement (SLA):
- Availability requirements
- Response times
- Security metrics

Right to Audit:
- On-site inspection rights
- Third-party audit acceptance
- Penetration testing rights

Data Protection:
- Encryption requirements
- Access controls
- Geographic restrictions
- Retention and disposal

What Is Software Acquisition Security?

Software acquisition has unique risks including licensing, updates, and code quality.

Software Acquisition Considerations:

ConsiderationSecurity Implication
SourceOfficial channels only
IntegrityVerify signatures/hashes
LicensingCompliance and support
UpdatesPatch availability
End of lifeSupport timeline

Software Verification:

Before installation:
1. Download from official source
2. Verify digital signature
3. Check hash/checksum
4. Scan for malware
5. Review permissions required

Open source considerations:
- Community reputation
- Update frequency
- Known vulnerabilities
- License implications

What Due Diligence Is Required?

Due diligence verifies vendor claims before commitment.

Due Diligence Activities:

ActivityPurpose
Background checkVerify company legitimacy
Financial reviewAssess stability
Reference checkValidate performance
Compliance verificationConfirm certifications
Technical reviewAssess product security

Due Diligence Process:

1. Identify requirements
   - Security needs
   - Compliance requirements
   - Business requirements

2. Evaluate vendors
   - Request information
   - Review documentation
   - Conduct assessments

3. Verify claims
   - Check certifications
   - Contact references
   - Independent testing

4. Document findings
   - Risk assessment
   - Recommendations
   - Decision rationale

How CompTIA Tests This

Example Analysis

Scenario: A healthcare organization is procuring a new cloud-based EHR (Electronic Health Record) system. The system will store PHI (Protected Health Information) for 50,000 patients. Design a secure procurement process.

Analysis - Healthcare Software Procurement:

Requirements Identification:

Regulatory:
✓ HIPAA compliance mandatory
✓ Business Associate Agreement required
✓ Breach notification obligations
✓ Audit trail requirements

Security:
✓ Encryption (at rest and in transit)
✓ Access controls (RBAC)
✓ Audit logging
✓ Multi-factor authentication

Vendor Assessment Process:

PhaseActivities
Initial screeningHIPAA compliance verification
Security questionnaire200+ security questions
Certification reviewSOC 2 Type II, HITRUST
Reference checkContact existing healthcare clients
Technical reviewSecurity architecture review

Security Questionnaire Categories:

1. Access Control
   - How is authentication implemented?
   - Is MFA supported/required?
   - What RBAC capabilities exist?

2. Data Protection
   - What encryption is used?
   - Where is data stored geographically?
   - How are backups protected?

3. Incident Response
   - What is breach notification timeline?
   - How are incidents investigated?
   - What forensic capabilities exist?

4. Compliance
   - What certifications are held?
   - When was last audit?
   - Can audit reports be shared?

Required Documentation:

DocumentPurpose
SOC 2 Type II reportIndependent security audit
HIPAA compliance attestationRegulatory compliance
Business Associate AgreementLegal obligations
Penetration test resultsTechnical vulnerabilities
Incident response planBreach handling

Contract Security Requirements:

Must include:
□ HIPAA Business Associate Agreement
□ Data encryption requirements (AES-256)
□ Right to audit clause
□ Breach notification (24-hour)
□ Data return/destruction at termination
□ Subcontractor flow-down requirements
□ Geographic data restrictions (US only)
□ Background check requirements for staff

Supply Chain Verification:

Software integrity:
- Signed software packages
- Verified update mechanisms
- Code signing certificates

Infrastructure:
- Data center certifications
- Physical security controls
- Network security architecture

Key insight: Healthcare procurement requires comprehensive vendor assessment due to PHI sensitivity and HIPAA requirements. The Business Associate Agreement creates legal obligations, but technical verification ensures those obligations can be met. Don't rely solely on contracts—verify technical capabilities.

Key Terms

acquisition procurementvendor assessmentsupply chain securitythird-party riskhardware securitysoftware procurement

Common Mistakes

Trusting vendor claims without verification—always verify certifications, audit reports, and references independently.
No security requirements in contracts—verbal promises have no enforcement. Put security requirements in writing.
Ignoring supply chain risks—even trusted vendors can be compromised. Verify hardware and software integrity.
One-time assessment only—vendor risk changes over time. Continuous monitoring is essential.

Exam Tips

Vendor assessment methods: questionnaires, on-site audits, third-party reports (SOC 2), penetration tests.
Supply chain security: tamper-evident packaging, authorized resellers, hardware verification, firmware validation.
Contract clauses: right to audit, incident notification, data handling, termination/data destruction.
Due diligence: verify certifications independently, check references, review audit reports.
SOC 2 Type II = third-party audit of security controls over time (vs Type I = point in time).
Business Associate Agreement (BAA) = required for HIPAA when vendor handles PHI.

Memory Trick

  • Vendor Assessment Methods - "QOAPR":
  • Questionnaire (written questions)
  • On-site audit (physical visit)
  • Audit reports (SOC 2, ISO)
  • Penetration test (technical)
  • Reference check (customers)
  • Supply Chain Risks - "CTCSI":
  • Counterfeit components
  • Tampering in transit
  • Compromise in build
  • Substitution of products
  • Insider threat at vendor
  • Contract Security - "RIDDT":
  • Right to audit
  • Incident notification
  • Data handling requirements
  • Destruction at termination
  • Termination procedures

Due Diligence Rule: "Trust but Verify" Verify certifications, check references, test claims

SolarWinds Lesson: "Your vendor's compromise is YOUR compromise" Supply chain security is essential

Test Your Knowledge

Q1.Which document provides independent third-party validation of a vendor's security controls over time?

Q2.What supply chain control helps detect physical tampering during shipping?

Q3.What contract clause allows an organization to verify a vendor's security controls?

Want more practice with instant AI feedback?

Continue Learning

Ready for the Exam?

See exactly where you stand on this concept and 182 others.

99% pass rate · Pass guarantee