Technical Procurement and Management
Domain 2 covers technical procurement and management: how security requirements survive the acquisition lifecycle and how you evaluate vendor evidence. The exam tests RFI, RFP, and SOW language; source-selection criteria; Common Criteria Protection Profiles and Security Targets; acceptance testing; and supply-chain risk management.
Core rules
- Convert mission security needs into measurable, testable procurement requirements with acceptance criteria.
- Flow down security obligations into contracts: configuration control, vulnerability disclosure, patch timelines, audit rights, data handling, and secure disposal.
- Distinguish vendor assertions from evidence: require test reports, certification scope statements, and validated configurations.
- Use standards such as Common Criteria for assurance claims, but confirm the evaluated configuration matches what you will deploy.
- Plan acceptance testing, integration testing, and regression testing before award; include security test cases.
- Manage COTS and GOTS dependencies, end-of-life risk, licensing, escrow, and supplier access.
Worked example
An agency buys an audit platform. The RFP requires tamper-evident logging, FIPS 140-3 validated cryptography for data at rest, role separation, and export in a specified schema. Source selection scores the cryptographic evidence and the evaluated configuration. The acceptance test verifies log integrity after an attempted deletion, validates role separation, and checks that the deployed version matches the certificate. Contract terms require 30-day notification of critical vulnerabilities and a patch SLA. The team rejects a lower-cost bid that cites a certificate but runs an unevaluated build.
Traps
Vague requirements such as 'secure by design'; accepting a certificate without checking version and configuration; missing supply-chain and escrow terms; no acceptance test; and allowing vendor-controlled updates without change control.