A large financial institution is integrating a third-party AI solution into its fraud detection system. Which is the BEST way to reduce AI vendor/supply chain risk?

The correct answer is B. Establish contractual agreements requiring evidence of secure development practices. Supply chain risk is fundamentally about trusting what a vendor delivers. Establishing contractual agreements requiring evidence of secure development practices (B) addresses the risk at its source - binding the vendor to security standards throughout the software development…

AI Security Risk Management

Question

Options

AConduct annual vulnerability assessments after integration
BEstablish contractual agreements requiring evidence of secure development practices
CUse isolated virtual environments to validate integration
DFocus on performance testing

How the community answered

(41 responses)

A
15% (6)
B
76% (31)
C
7% (3)
D
2% (1)

Explanation

Supply chain risk is fundamentally about trusting what a vendor delivers. Establishing contractual agreements requiring evidence of secure development practices (B) addresses the risk at its source - binding the vendor to security standards throughout the software development lifecycle (e.g., SDLC controls, vulnerability management, and code review). Annual assessments after integration (A) are reactive and infrequent. Isolated validation environments (C) test your own integration but do not govern how the vendor builds their product. Performance testing (D) ignores security entirely.

Topics

#AI vendor risk#Supply chain security#Contractual agreements#Secure development practices

Community Discussion

No community discussion yet for this question.

Full AAISM Practice