Answer per control. Each answer feeds the evaluation and the traceability chain Actor → Vector → Component → Effect → Audit.
Do contracts grant the buyer enforceable right to audit suppliers and sub-suppliers?
Without an enforceable right-to-audit clause that flows down to sub-suppliers, security claims are unverifiable. The clause must allow on-site visits, document inspection and follow-up audits, not just self-attestations.
Are vendors contractually required to deliver SBOMs, test reports and attestations?
If suppliers are not contractually required to deliver SBOMs, test reports and attestations at defined milestones, you will not receive them. The evidence register lists exactly what is due, by when, and the acceptance criteria.
Is there a substitution / second-source plan for components from high-risk jurisdictions?
If a critical component comes from a jurisdiction that becomes hostile (export ban, sanction, sabotage risk), the platform is grounded unless a substitution plan exists. The plan names alternatives, qualification effort and lead-time per component.
Does the buyer retain technical and legal rights to patch firmware independently?
If only the original vendor can sign firmware, and that vendor disappears or refuses to patch a vulnerability, the buyer is stuck. Source escrow plus custody of signing keys (or a co-signing arrangement) preserves the buyer's ability to patch.
Are security clauses contractually flowed down to all relevant Tier-2/3 sub-suppliers?
Security clauses written between the buyer and Tier-1 do nothing if Tier-1's contracts with Tier-2/3 are silent. Mandatory flow-down with sub-supplier acknowledgements is the only way to extend the security regime to the actual risk locations.
Is critical source code, build toolchain and signing key material held in escrow with defined release triggers?
Source code escrow without the build toolchain and signing keys is often useless — you cannot reproduce the binary the device accepts. Escrow must cover all three, with documented release triggers (vendor bankruptcy, refusal to patch, etc.).
Are suppliers contractually obliged to disclose security incidents and vulnerabilities within a defined window?
Suppliers learn about incidents and vulnerabilities affecting their products before customers do. A contractual disclosure window (e.g. 72 hours for incidents, defined CVE disclosure rules) ensures the buyer can act before exploitation spreads.
Is there a contractual EOL / obsolescence plan including last-time-buy, re-design and security-patch tail?
Electronics have shorter lifecycles than platforms. Without a contractual EOL plan (last-time-buy notice, re-design support, security-patch tail beyond active production), the platform becomes unmaintainable and insecure mid-life.
