baselineRFIWhat SBOM capabilities does the product provide — generation (SPDX/CycloneDX), ingestion of third-party SBOMs, and continuous reconciliation against what's actually deployed?weight 3
Answer key — what a strong answer shows
Look for both standard formats and — the harder part — reconciliation of SBOMs against deployed reality; a point-in-time SBOM that drifts from production is compliance theater.
baselineRFPDescribe malicious-package detection (typosquatting, dependency confusion, hijacked maintainer accounts, install-script malware) — what is the detection methodology, and what is the measured time from a malicious package appearing in a registry to your feed flagging it?weight 3
Answer key — what a strong answer shows
Strong answers name the behavioral/heuristic methodology and give a real time-to-flag figure — signature-only or CVE-only approaches miss the malicious-package class entirely (these aren't 'vulnerabilities').
baselineRFIHow does the product prioritize vulnerable dependencies — does it distinguish reachable/exploitable vulnerabilities (called from your code) from vulnerable-but-unreachable ones, and what is the typical noise reduction from reachability analysis?weight 3
Answer key — what a strong answer shows
Reachability analysis is the difference between thousands of alerts and dozens; look for a stated methodology (call-graph analysis) and a real noise-reduction figure.
baselineRFIWhat build-pipeline integrity features are supported — provenance attestation (SLSA levels, in-toto), signed builds, and verification that what's deployed matches what was built?weight 3
Answer key — what a strong answer shows
Look for concrete SLSA-level claims with attestation artifacts, not just 'we secure your pipeline' — provenance is verifiable or it's nothing.
baselineRFPDetail secrets-in-code detection across the SDLC (pre-commit, CI, retroactive history scans) and the remediation workflow when a live credential is found in a public or internal repo.weight 3
Answer key — what a strong answer shows
Strong answers cover all three scan points plus an actual remediation workflow (auto-revocation integration, not just an alert) and validity-checking to separate live credentials from dead ones.
baselineRFIHow does the product handle license compliance — detection of copyleft/incompatible licenses in dependencies, policy enforcement in CI, and legal-report generation?weight 3
Answer key — what a strong answer shows
License risk is part of supply-chain risk; look for policy-as-code enforcement in CI with legal-consumable reporting, not just a license inventory list.
baselineRFPExplain container/image supply-chain coverage — base-image vulnerability tracking, image signing/verification (Sigstore/cosign), and registry-level admission control blocking unsigned or policy-violating images.weight 3
Answer key — what a strong answer shows
Look for the full chain: signed images, verification at admission, and base-image update automation — scanning alone without admission control doesn't prevent anything.
baselineRFIWhat developer-experience guardrails exist to keep this from becoming a blocker — PR-level feedback with fix suggestions, auto-remediation PRs for dependency upgrades, and measured false-positive rates?weight 3
Answer key — what a strong answer shows
Supply-chain tools fail by being ignored; look for in-PR feedback, automated upgrade PRs, and an honest false-positive figure — developer adoption is the real success metric.
baselineRFIWhat is the pricing model — per developer, per repository, or per build — and how does cost scale as the organization's dependency count and build volume both grow significantly?weight 3
Answer key — what a strong answer shows
Look for transparent, predictable scaling economics; a vendor unable to project cost at meaningfully higher scale creates real budget risk for a growing engineering organization.
baselineRFPDescribe incident-response capability for a confirmed supply-chain compromise already deployed to production (e.g., a malicious package discovered after it shipped) — can the platform quickly identify every affected build/deployment across the environment, and what is a customer-referenced turnaround time?weight 3
Answer key — what a strong answer shows
Strong answers describe a fast, comprehensive blast-radius query capability with a real turnaround-time figure — this is the highest-stakes use case (an actual live compromise), not just preventive scanning.
baselineRFIDoes the platform map coverage to named supply-chain-security frameworks (Executive Order 14028, NIST SSDF, SLSA levels) with audit-ready reporting, and at what SLSA level does the platform's own recommended pipeline configuration achieve?weight 3
Answer key — what a strong answer shows
Look for explicit, named framework/level mapping rather than a vague 'follows best practices' claim — SLSA levels specifically are a concrete, checkable claim.
baselineRFPDetail historical trend reporting on supply-chain risk posture (vulnerable-dependency count, unsigned-build count, secrets-found count) over time, suitable for demonstrating program maturity progress to leadership.weight 3
Answer key — what a strong answer shows
Trend-over-time reporting is a distinct capability from a real-time dashboard — confirm this exists as a maintained, exportable report.
baselineRFIHow does the platform integrate with (versus duplicate) the customer's existing vulnerability management and ASPM tooling — does supply-chain risk feed into the same unified risk view, or is it a separate, disconnected dashboard?weight 3
Answer key — what a strong answer shows
Look for genuine integration into a unified risk view; a standalone supply-chain dashboard disconnected from the broader AppSec/VM picture creates real reconciliation burden.
baselineRFIWhat is the breadth of language/ecosystem coverage (npm, PyPI, Maven, Go modules, Rust crates, NuGet, etc.), and is coverage depth uniform across all of them, or meaningfully shallower for less-common ecosystems the vendor should disclose honestly?weight 3
Answer key — what a strong answer shows
Ask for an honest per-ecosystem coverage breakdown; a vendor with uneven ecosystem coverage should disclose which languages get shallower treatment rather than implying uniform depth across everything.
baselineRFPWhat is the measured false-positive rate specifically on malicious-package detection (flagging a legitimate package as malicious), and what is the remediation/appeal process if a legitimate package/release is incorrectly blocked, given the business-disruption risk of a false block?weight 3
Answer key — what a strong answer shows
A false positive on malicious-package detection can break a production build or block a legitimate release — ask for a real accuracy figure and a fast appeal/override process, not just a detection-rate claim.
baselineRFIDoes the platform support air-gapped or private-registry environments common in regulated/government customers, where dependencies can't be resolved against public registries for real-time reputation/malware checks?weight 3
Answer key — what a strong answer shows
Look for a genuine offline/private-registry operating mode; a platform requiring live internet access to public registries for every scan has a real deployment gap for regulated air-gapped environments.
baselineRFPComplete the Supply Chain information (TVE Sheet 5), disclosing the vendor's supply chain for evaluation.weight 3
baselineRFPComplete the North American Transmission Forum (NATF) Vendor Questionnaire, addressing NATF's cybersecurity supply-chain criteria for suppliers.weight 3
baselineRFPAny proposal must be compliant with FCC Order 19-121, which prohibits the sale, provision, maintenance, modification, or other support of equipment or services from Huawei, ZTE, or any other covered company (including Kaspersky Lab) posing a national-security threat to communications networks or the supply chain; by submitting a response, vendors certify compliance.weight 3
baselineRFPContractor shall support Supply Chain Risk Management (SCRM) activities, including coordination, record maintenance, and risk mitigation recommendations for third-party technologies, and support AI security-related compliance, vulnerability, and risk activities for systems/tools that incorporate AI-enabled functions or emerging technologies.weight 3
baselineRFPContractor shall be responsible for establishing and managing a Supply Chain Risk Management (SCRM) Program per NDAA FY2019, Executive Order 14028, and applicable federal agency guidance, including developing an SCRM program charter and plan, operating and enhancing SCRM with vendor risk intelligence and continuous monitoring integrated with IT Architecture/Standards, Procurement, and OGC, and developing OKRs demonstrating SCRM program success.weight 3
baselineRFPIs it possible for any third party (your service providers) to access data, and if so, how?weight 3
These questions and weights are the reviewed standard for this category — start scoring straight away. To change them, or to import your own questions from a spreadsheet and reuse them on every evaluation, create a free buyer account.
