Software-Vendor Due Diligence: Evidence First

Software-vendor due diligence is an investigation of a particular supplier, product, release, and intended use—not a completed questionnaire or a universal security score. The series starts by resolving identity, criticality, jurisdiction, provenance, dependencies, and tiers; builds a source-backed evidence packet; then examines OpenSSF Scorecard findings, outcomes, aggregation, access, and output formats as bounded technical observations. It shows how to route gaps to public research, corroborating artifacts, targeted supplier questions, remediation, acceptance, escalation, or policy gates. The organizing rule is to preserve each source’s scope, date, detection conditions, and uncertainty: NIST’s broader C-SCRM categories and Scorecard’s selected software signals inform different parts of the decision. A living record then refreshes evidence when suppliers, releases, dependencies, incidents, or system use change. The series supports traceable, proportionate decisions, but it does not turn partial visibility, supplier claims, or a score into proof that a vendor or product is secure.