Procurement Officer

Buyers already require product changes as a condition of purchase: uptime, scalability, interoperability, API support. Manufacturers move roadmaps to meet those demands.

Ask what security they require and you get backups, encryption, audit logs, HTTPS. Every one is a feature that can be added. None is a property of the code.

Buyers are not failing to demand security. They are demanding the half a datasheet can show (see E-01, MI-03).

Discussion prompts

• What in your last contract would require a manufacturer to change how they build software?
• What would a manufacturer have to publish for you to check something you currently take on trust?
• If Secure-by-Demand became your procurement standard, what would be the first requirement, and which manufacturers would it disqualify?