ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

The most effective way to ensure that purchased assets satisfy mandatory security requirements is to embed those requirements directly into the procurement documents and demand objective proof from vendors. By adding a clause to the request for proposal (RFP) that specifies "FIPS 140-3 Level 3 validated" and obliges bidders to provide their official NIST validation certificates, the acquisition team filters out non-compliant products before any purchase decisions are made. Relying on a vendor's self-attestation, delaying evaluation until after deployment, or planning to compensate later all introduce unnecessary risk and may violate organizational policy. Therefore, documenting the requirement in the RFP and requiring evidence of current validation is the correct approach.