ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question

An independent, recently completed SOC 2 Type II (or comparable) assurance report provides the highest level of confidence that a supplier follows documented secure development practices. Such reports are issued by a qualified third-party auditor after reviewing the vendor's policies, developer training, code control, testing, and release processes over a sustained period, and they map the evidence collected to established security control criteria (for example, AICPA Trust Services Criteria or mappings to frameworks like NIST SSDF). A vendor marketing statement is merely self-attested and unaudited. Results from a single penetration test are point-in-time and assess only the deployed application, not the underlying SDLC processes. Internal code-review checklists can be helpful, but without external validation they do not demonstrate actual, consistent adherence to secure development practices. Therefore, the third-party audit report is the most reliable source for verifying compliance.