Acquisition and Procurement
Security considerations when acquiring hardware and software including vendor assessment, supply chain security, and third-party risk management throughout the procurement lifecycle.
Understanding Acquisition and Procurement
Acquisition and procurement security ensures that hardware, software, and services are secure before they enter your environment. Supply chain attacks compromise products before delivery, making vendor assessment and secure procurement essential.
Key acquisition considerations: • Vendor assessment — Evaluate security posture before purchase • Supply chain security — Protect against tampering in transit • Contract requirements — Define security obligations • Due diligence — Verify claims and certifications
The 2020 SolarWinds attack demonstrated supply chain risk at scale—attackers compromised the build process, inserting malware into legitimate software updates. Over 18,000 organizations installed the trojanized update, including government agencies and Fortune 500 companies.
What you buy becomes part of your security posture. Trust but verify.
Why This Matters for the Exam
Acquisition and procurement security is tested on SY0-701 because supply chain attacks are increasingly common. Questions cover vendor assessment, procurement controls, and supply chain risks.
Understanding procurement security helps with vendor management, risk assessment, and compliance requirements. A compromised vendor becomes your compromise.
The exam tests recognition of procurement risks and appropriate security controls.
Deep Dive
What Is Vendor Assessment?
Vendor assessment evaluates a supplier's security posture before establishing a business relationship.
Vendor Assessment Components:
| Component | Purpose |
|---|---|
| Security questionnaire | Assess policies and controls |
| Certifications | Verify third-party validation |
| Audit reports | Review independent assessments |
| Penetration test results | Understand vulnerabilities |
| Financial stability | Assess business continuity |
Assessment Methods:
| Method | Description |
|---|---|
| Questionnaire | Written security questions |
| On-site audit | Physical inspection |
| Third-party audit | SOC 2, ISO 27001 |
| Penetration test | Technical assessment |
| Reference check | Customer feedback |
Vendor Risk Tiers:
Tier 1 - Critical: - Access to sensitive data - Critical infrastructure - Annual on-site audit - Quarterly reviews Tier 2 - Significant: - Business-critical services - Limited data access - Annual questionnaire - Semi-annual reviews Tier 3 - Standard: - Commodity services - No sensitive access - Initial assessment - Annual review
What Is Supply Chain Security?
Supply chain security protects products from tampering during manufacturing, shipping, and delivery.
Supply Chain Risks:
| Risk | Example |
|---|---|
| Counterfeit | Fake components with backdoors |
| Tampering | Modification during shipping |
| Compromise | Malware in build process |
| Substitution | Different product than ordered |
| Insider threat | Malicious employee at vendor |
Supply Chain Controls:
| Control | Purpose |
|---|---|
| Trusted suppliers | Vetted vendor list |
| Tamper-evident packaging | Detect physical access |
| Chain of custody | Track product handling |
| Hardware verification | Validate authenticity |
| Firmware validation | Check for modification |
Hardware Supply Chain:
Risks at each stage: Manufacturing → Component substitution Shipping → Physical tampering Storage → Access by unauthorized personnel Delivery → Last-mile compromise Controls: - Authorized resellers only - Tamper-evident seals - Serial number verification - Hardware attestation
What Should Procurement Contracts Include?
Security requirements must be contractually defined.
Contract Security Clauses:
| Clause | Purpose |
|---|---|
| Security requirements | Define minimum standards |
| Right to audit | Allow security assessments |
| Incident notification | Require breach reporting |
| Data handling | Specify data protection |
| Termination | Address data return/destruction |
Key Contract Elements:
Service Level Agreement (SLA): - Availability requirements - Response times - Security metrics Right to Audit: - On-site inspection rights - Third-party audit acceptance - Penetration testing rights Data Protection: - Encryption requirements - Access controls - Geographic restrictions - Retention and disposal
What Is Software Acquisition Security?
Software acquisition has unique risks including licensing, updates, and code quality.
Software Acquisition Considerations:
| Consideration | Security Implication |
|---|---|
| Source | Official channels only |
| Integrity | Verify signatures/hashes |
| Licensing | Compliance and support |
| Updates | Patch availability |
| End of life | Support timeline |
Software Verification:
Before installation: 1. Download from official source 2. Verify digital signature 3. Check hash/checksum 4. Scan for malware 5. Review permissions required Open source considerations: - Community reputation - Update frequency - Known vulnerabilities - License implications
What Due Diligence Is Required?
Due diligence verifies vendor claims before commitment.
Due Diligence Activities:
| Activity | Purpose |
|---|---|
| Background check | Verify company legitimacy |
| Financial review | Assess stability |
| Reference check | Validate performance |
| Compliance verification | Confirm certifications |
| Technical review | Assess product security |
Due Diligence Process:
1. Identify requirements - Security needs - Compliance requirements - Business requirements 2. Evaluate vendors - Request information - Review documentation - Conduct assessments 3. Verify claims - Check certifications - Contact references - Independent testing 4. Document findings - Risk assessment - Recommendations - Decision rationale
How CompTIA Tests This
Example Analysis
Scenario: A healthcare organization is procuring a new cloud-based EHR (Electronic Health Record) system. The system will store PHI (Protected Health Information) for 50,000 patients. Design a secure procurement process.
Analysis - Healthcare Software Procurement:
Requirements Identification:
Regulatory: ✓ HIPAA compliance mandatory ✓ Business Associate Agreement required ✓ Breach notification obligations ✓ Audit trail requirements Security: ✓ Encryption (at rest and in transit) ✓ Access controls (RBAC) ✓ Audit logging ✓ Multi-factor authentication
Vendor Assessment Process:
| Phase | Activities |
|---|---|
| Initial screening | HIPAA compliance verification |
| Security questionnaire | 200+ security questions |
| Certification review | SOC 2 Type II, HITRUST |
| Reference check | Contact existing healthcare clients |
| Technical review | Security architecture review |
Security Questionnaire Categories:
1. Access Control - How is authentication implemented? - Is MFA supported/required? - What RBAC capabilities exist? 2. Data Protection - What encryption is used? - Where is data stored geographically? - How are backups protected? 3. Incident Response - What is breach notification timeline? - How are incidents investigated? - What forensic capabilities exist? 4. Compliance - What certifications are held? - When was last audit? - Can audit reports be shared?
Required Documentation:
| Document | Purpose |
|---|---|
| SOC 2 Type II report | Independent security audit |
| HIPAA compliance attestation | Regulatory compliance |
| Business Associate Agreement | Legal obligations |
| Penetration test results | Technical vulnerabilities |
| Incident response plan | Breach handling |
Contract Security Requirements:
Must include: □ HIPAA Business Associate Agreement □ Data encryption requirements (AES-256) □ Right to audit clause □ Breach notification (24-hour) □ Data return/destruction at termination □ Subcontractor flow-down requirements □ Geographic data restrictions (US only) □ Background check requirements for staff
Supply Chain Verification:
Software integrity: - Signed software packages - Verified update mechanisms - Code signing certificates Infrastructure: - Data center certifications - Physical security controls - Network security architecture
Key insight: Healthcare procurement requires comprehensive vendor assessment due to PHI sensitivity and HIPAA requirements. The Business Associate Agreement creates legal obligations, but technical verification ensures those obligations can be met. Don't rely solely on contracts—verify technical capabilities.
Key Terms
Common Mistakes
Exam Tips
Memory Trick
- •Vendor Assessment Methods - "QOAPR":
- •Questionnaire (written questions)
- •On-site audit (physical visit)
- •Audit reports (SOC 2, ISO)
- •Penetration test (technical)
- •Reference check (customers)
- •Supply Chain Risks - "CTCSI":
- •Counterfeit components
- •Tampering in transit
- •Compromise in build
- •Substitution of products
- •Insider threat at vendor
- •Contract Security - "RIDDT":
- •Right to audit
- •Incident notification
- •Data handling requirements
- •Destruction at termination
- •Termination procedures
Due Diligence Rule: "Trust but Verify" Verify certifications, check references, test claims
SolarWinds Lesson: "Your vendor's compromise is YOUR compromise" Supply chain security is essential
Test Your Knowledge
Q1.Which document provides independent third-party validation of a vendor's security controls over time?
Q2.What supply chain control helps detect physical tampering during shipping?
Q3.What contract clause allows an organization to verify a vendor's security controls?
Want more practice with instant AI feedback?
Continue Learning
Ready for the Exam?
See exactly where you stand on this concept and 182 others.
99% pass rate · Pass guarantee