What does supply chain security governance involve?

• A. Monitoring only internal systems' security.
• B. Oversight of security practices across vendors and suppliers, including assessments and contractual requirements.
• C. Hiring security personnel for the in-house team only.
• D. Focusing solely on product quality, not security.

Answer: (B)

Supply chain security governance is about establishing a framework to manage security risks that come from the entire network of external partners—vendors, suppliers, service providers, and contractors involved in delivering a product or service. It involves defining policies and roles, setting security requirements in contracts, conducting risk assessments of third parties, and continuously monitoring and auditing their practices. The best choice captures this broad oversight across vendors and suppliers, plus assessments and contractual requirements, which is exactly what governance in the supply chain requires. Focusing only on internal systems misses external risk, hiring personnel for the in-house team only leaves third-party risk unaddressed, and concentrating on product quality alone neglects security risks from suppliers that could affect the final product.