Score yourself on twelve yes or no questions about inventory, scanning, builds, access and response. Count yeses, mark partly where it is not everywhere, and fix the nos in order of how often buyers ask. Eight or more yeses with a plan for the rest usually makes a first review smoother.
How to use it
Answer as an outsider would. If you must say "usually" or "we think so," mark partly. Do the exercise with one engineer and one person from the business side, so technical and commercial views both appear.
The twelve questions
| # | Question | If no, next step |
|---|---|---|
| 1 | Do you have a list of every production repository with an owner? | Build it from deployments |
| 2 | Do you keep an SBOM or inventory for each release? | Generate in CI |
| 3 | Does dependency scanning run on every pull request? | Add a required check |
| 4 | Does it also run on a schedule? | Add a daily rescan |
| 5 | Do you commit lockfiles and install from them in CI? | Switch to strict installs |
| 6 | Do you have written timelines for fixing critical findings? | Draft tiers |
| 7 | Do you keep a register of accepted findings with review dates? | Start one |
| 8 | Is review required before merging to the default branch? | Turn on branch rules |
| 9 | Does CI use short lived credentials rather than stored cloud keys? | Move to identity based access |
| 10 | Do you know who can publish packages, images or releases? | Run an access review |
| 11 | Do you have a one page plan for a compromised dependency? | Write it |
| 12 | Do you list vendors that touch customer data? | Start a register |
Reading your score
| Yeses | What it suggests |
|---|---|
| 0 to 4 | Start with questions 1, 2, 3 and 8, which unlock the rest |
| 5 to 8 | You can answer most questions, but evidence may be thin |
| 9 to 12 | Focus on proof: dated exports and consistent answers |
Treat the numbers as a conversation starter. A team scoring seven with good evidence can beat one scoring ten with none.
Turn gaps into a plan
Sort the nos by effort and impact. Items 1, 3 and 8 are usually quick and cover many questionnaire lines. Items 2 and 9 take longer but change how you work. Put the first five into a 90 day plan with owners, and share it only when you are sure of the dates. Our roadmap guide shows how to write one.
Pair it with a framework
If your buyer asks about a secure development framework, NIST SP 800-218 gives a common vocabulary of practices. It is guidance, not a certification, so use it to map your controls and be careful with wording. A mapping table from each question above to a practice is a good appendix.
Retest
Run the check again every quarter. Controls drift, and a repository added last month may have skipped scanning.
Try it yourself
Click through it at your own pace, or open it full screen. See how one control maps to several frameworks, which is how you reuse the twelve answers above across buyers.
Safeguard supports SBOM and dependency scanning, policies and gates, and compliance and evidence automation, which cover several of these questions. Start with a free scan.
Quick check
Is a score of 12 required to start selling?
No. Buyers look for honest, evidenced answers and a believable plan, not perfection.
Which question matters most?
Question 1. Without a complete repository list, every other answer risks being incomplete.
Sources
Last reviewed: 19 October 2026.
