14 Questions to Assess Your Software Vendor Supply-Chain Risk

The SolarWinds breach provides a useful reminder that modern adversaries, both cybercriminals and hostile state-actors, continue to innovate and evolve in sophistication, guile, and persistence.
Implementing a full-bore ISO/IEC or NIST security framework is often beyond the needs and resources of many organizations, but the philosophy behind them can still useful. A framework-based mindset can help you to identify areas where existing processes can be ​strengthened and new processes implemented, as well as prioritize your security requirements and set appropriate expectations with your suppliers and partners.