Exam CISSP topic 1 question 435 discussion

Answer C) Vulnerability Assessment Effectively managing cyber supply chain risk requires a comprehensive view of threats and vulnerabilities. Although it is good practice to have 3rd party review the product, it does not help if a vulnerability assessment hasn't been done to show what needs to be addressed/fixed. https://csrc.nist.gov/csrc/media/Projects/cyber-supply-chain-risk-management/documents/C-SCRM_Fact_Sheet.pdf

CISSP 9th Edition Page 32....

I would have to agree with the chosen answer here, to ensure the requirements are met, a third-party assessment is needed. C is a vulnerability assessment, while best practice to conduct these often, it can be flawed and biased

i think the answer should be C: The most important methodology to ensure that supply chain risk management (SCRM) requirements are met throughout the Systems Development Life Cycle (SDLC) is the "threat modeling" methodology. Threat modeling is a structured approach for identifying and evaluating potential threats and vulnerabilities in a system, including those that may arise from the supply chain. By systematically analyzing the system architecture, data flows, and potential attack vectors, threat modeling can identify areas where SCRM controls need to be implemented to mitigate risks.