Know what the service depends on
A connected platform can include third-party libraries, firmware, container images, runtimes, management software, and external services. Each dependency has an owner and a lifecycle. CISA’s buyer guidance asks manufacturers about provenance and software bills of materials, or SBOMs. These records can support visibility, but collecting them is not the same as assessing or resolving risk. Identify which products are deployed and connect dependency information to the actual versions and configurations in service.
Evaluate supplier processes, not just documents
Ask how a manufacturer assesses components, receives vulnerability reports, maintains software, and communicates affected products. CISA’s secure-by-design principles emphasize accountability and eliminating systemic weaknesses rather than leaving every customer to compensate for avoidable defects. A supplier should explain how its practices affect the supported product. An SBOM delivered once at purchase can become stale if it is not tied to later releases and a practical process for keeping customers informed.
Turn a dependency finding into a decision
When a component issue is identified, determine whether the deployed system is affected and which owner can assess it. Prioritize action using the organization’s context and qualified analysis, not a simplistic count of library names. Record the review, approved mitigation or update, and verification. Avoid introducing unsupported changes merely to clear a dashboard. A supply-chain program needs a route from inventory to accountable action, including the operating team and vendor when their responsibilities intersect.
Preserve provenance across updates
Track approved release sources, component changes, and relevant support periods. Test the installation and recovery process before broad rollout. Include managed services and AI-related tools in the supplier inventory where appropriate. Future network platforms may change the software mix without changing the fundamental requirement for maintainable dependencies. Supply-chain security becomes useful when teams can identify what is running, understand its origin and support, and act coherently when a component no longer meets the service’s risk requirements.