What is the goal of the secure sourcing phase, and what typically goes wrong?

Make sure externally sourced components meet the security requirements and are integrated securely.

Most products are largely made of things the company didn't write: commercial libraries, open source, cloud services and outsourced development. The Project Lead is responsible.

1. Define requirements for suppliers and components.
2. Select the provider, using pre-defined selection guidelines.
3. Source the components, with contract templates that carry the security requirements.
4. Ensure secure delivery: the package arrives unaltered.
5. Acceptance testing, integrated with the test plans.

The pitfalls are undocumented third-party components (no one patches what no one knows is there), stakeholders left out of supplier selection, and security requirements missing from contracts. A missing clause cannot be enforced later.

Go deeper:

• NIST SP 800-161r1 — Cybersecurity supply chain risk management — the reference for supplier requirements and acceptance