Which of the following addresses requirements of security assessments during software acquisition?

Software configuration management (SCM) focuses on controlling and tracking changes to software after it has been acquired or developed, not on evaluating security risks during the acquisition process itself.

A data loss prevention (DLP) policy is designed to prevent unauthorized exfiltration or exposure of sensitive data and does not address the security vetting of software being acquired from vendors.

Continuous monitoring is an operational security practice used to maintain ongoing visibility into a deployed system's security posture, and does not govern the security assessment requirements prior to or during software acquisition.

A software assurance policy establishes the security requirements, vetting procedures, and risk assessment criteria that must be applied when acquiring software from external vendors or sources. It directly addresses the need to evaluate software for vulnerabilities, supply chain risks, and compliance with security standards before procurement. This aligns with frameworks like NIST SP 800-161 and CMMC, which mandate software assurance as part of acquisition security.