Secure by Demand: Going Beyond Questionnaires and SBOMs

This piece outlines CISA’s Secure by Demand guidance for software procurement, emphasizing key areas such as authentication, vulnerability elimination, logging, supply chain security, and disclosure. It argues that questionnaires and SBOMs are necessary but insufficient for true risk assessment, urging buyers to “trust but verify” with independent validation. The article promotes ReversingLabs’ Spectra Assure and its SAFE Report as a way to provide verifiable, actionable insights into third-party software security, addressing risks like malware, tampering, and exposed secrets beyond traditional TPRM methods.