Organize supplier questions by attack class instead of by control family. Ask about registry and package resolution for dependency confusion, publishing and review for hijacked maintainers, build integrity for pipeline compromise, and update and rollback practice for malicious updates. Good answers name a mechanism and offer evidence.
Why reorganize
Generic questionnaires ask whether a supplier has a secure development process. That yields a yes. Class based questions force specifics, and specifics are what separate a mature supplier from one that copies policy language. NIST describes its Secure Software Development Framework as a common vocabulary purchasers can use when communicating with suppliers, which is a good anchor for wording.
The question sets
Dependency confusion
- How do builds resolve internal package names, and from how many sources?
- Are internal names scoped or reserved on public registries?
Compromised maintainer or publisher
- Who can publish a release, and is a second person required?
- Are publishing credentials short lived, and how often are they reviewed?
- Do you delay adopting brand new third party versions?
Build system compromise
- Are builds isolated and ephemeral?
- Can you provide provenance linking a release to a commit and a builder?
- Who can change build definitions, and with what review?
Malicious update
- Do you stage updates to customers?
- Can customers pin or defer, and can you roll back quickly?
- How do you tell customers if a release is withdrawn?
Cross cutting
- Can you produce a software bill of materials for a given release?
- What is your notification process and timeline if you are affected?
Reading answers
| Answer | Reading |
|---|---|
| Names a control, owner and evidence | Strong |
| States a policy without mechanism | Needs follow up |
| Cites a certification only | Ask what it covers and its scope |
| Declines to answer | Note the risk and decide |
Keep it proportionate
A small utility does not need the depth you want from a vendor with deep access to your network. Rank suppliers by access and blast radius, then spend time on the top few.
Keep your own house in order
Buyers get the same questions from their customers. Maintaining a reusable answer library, backed by current evidence, saves time on both sides.
Follow up when answers are thin
If an answer is vague, ask for one artifact: a redacted build configuration, a sample provenance record, a sanitized change review, or the date of the last update rollback test. One real artifact tells you more than a page of policy text. If a supplier cannot share anything, record that and weigh it against how much access the supplier has.
Quick check
Should every supplier get the full list?
No. Tier suppliers by access to your systems and data, then scale the depth.
Is a certification an answer?
It is a data point. Ask what it covers, because its scope may not include the controls you care about.
Where Safeguard fits
Safeguard offers compliance and evidence automation and SBOM generation, which help you answer these questions as a supplier too. The free scan is one place to start.
Sources
Last reviewed: 19 October 2026.
