SOFTWARE ASSURANCE / RESOURCE SELECTION
Know what you
depend on.
A reading guide for people who build, buy, and rely on software.
The software behind a service often involves several organisations. These resources help you put clearer questions to the people responsible for its development, supply, and support.
Begin with a business dependency.
Choose software that matters to a critical service. Establish who owns that service, who supplies the software, and who would respond if a vulnerability or compromised update affected it.
Different teams need different guidance. A secure-development framework helps a software producer organise its practices; a buyer also needs procurement, support, and response arrangements. Neither side can answer the other’s questions by sending a generic policy.
FOUR COMPLEMENTARY RESOURCES
Pick the reading that fits your responsibility.
Understand the problem
Google’s Perspectives on Security, Volume One, examines software supply-chain risk and approaches to improving resilience.
Organise development practices
NIST’s Secure Software Development Framework provides a common language for producers and buyers to discuss secure development.
Review a software purchase
The Enduring Security Framework’s customer guide addresses acquiring, deploying, and managing software.
Look across your suppliers
The NCSC collection presents principles for understanding risk, establishing control, checking arrangements, and improving them.
Publisher materials have different dates and scopes. Read each in context; a framework or guide does not certify the security of a particular product.
THE MANAGEMENT CONVERSATION
Ask for evidence at the point of reliance.
WHEN BUYING
What are we relying on?
Identify the service, the information involved, and the business consequence if it becomes unavailable or unreliable. Confirm the support period and the route for urgent security notifications.
WHEN BUILDING
How are changes controlled?
Ask the development owner to explain how components are selected, changes are reviewed, releases are protected, and vulnerabilities are addressed. Look for evidence relevant to your product and its risks.
WHEN OPERATING
Who acts when something changes?
Agree who receives supplier advisories, determines exposure, and authorises remediation or recovery. Include any external provider whose help you would need.
DO NOT STOP AT AN INVENTORY
A component list needs
an owner and a response.
Knowing that a component is present is useful. The next question is whether a specific issue affects your deployment and what action is justified. Ask who will make that assessment, using what evidence, and how the decision will reach the service owner.
A WORKABLE NEXT STEP
Review one important product end to end.
Bring procurement, the service owner, and the technical team together around one dependency. Record the unanswered questions, request the missing evidence, and agree how findings will influence a purchase or continued use.
The aim is a decision you can explain. A long questionnaire with no review owner is unlikely to improve the arrangement on its own.
Make supplier assurance part of the service.
CyberSolace can help you define proportionate supplier questions and connect their answers to business risk.
SOURCES & REVIEW
Google report · NIST SSDF · ESF customer guide · NCSC supply-chain guidance. Practical review questions are CyberSolace commentary.
Originally published 15 December 2022. Resource links and presentation reviewed 20 October 2026.