The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Choose a software development company by checking how it will deliver, secure, verify, and support your specific project—not by relying on a polished pitch or a logo-filled portfolio. Use this 15-point checklist to ask for evidence, make responsibilities explicit, and compare proposals on the same practical terms.
The checklist is an editorial framework informed by U.S. NIST and CISA procurement and cybersecurity guidance, not an official standard or a universal scoring system. Adapt it to your project, risk, and jurisdiction.
As an Amazon Associate I earn from qualifying purchases.
Start with the work and the people
-
Look for relevant work
Ask for examples that resemble your problem, technical environment, constraints, and users. Discuss what the firm actually delivered and what its role was. A similar project is useful evidence to examine, not a promise that yours will go the same way. NIST’s Software Cybersecurity for Producers and Purchasers supports requesting information from suppliers, but does not prescribe a universal portfolio test.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesSpecial offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Find out who will do and oversee the work
Ask who will perform the engineering, make technical decisions, manage delivery, and handle security. Clarify whether any work will be delegated to subcontractors or other service providers, and what those parties will do. CISA’s vendor-assessment materials treat supplier responsibilities and obligations as part of due diligence.
#1 Best Overall
-
Verify the supplier’s identity
Confirm the legal entity you would contract with and request traceable company information. Make sure the proposal, agreement, invoices, and named delivery organization refer to the same supplier, or clearly explain their relationship. NIST’s supply-chain due-diligence guide identifies foundational company checks as an early step.
-
Ask about supply-chain tiers and provenance
Find out which suppliers, software components, and service providers are involved, and what information the company can provide about them. For a consequential system, ask how it tracks where important components come from and what happens when a supplier or component changes. NIST identifies supply-chain tiers and provenance as due-diligence considerations.
Make the project and its security expectations concrete
-
Define scope and deliverables
Write down what the company will deliver, the assumptions it relies on, what is excluded, what you must provide, and how completion will be judged. Include relevant dependencies such as access to systems, data, or third-party services. The reviewed official guidance does not prescribe a particular statement-of-work template, so tailor the document to the project.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Understand the secure-development process
Ask the supplier to explain how security practices are built into work throughout the software life cycle—not only at release. NIST recommends lifecycle-wide attestation: “Require attestation to cover secure software development practices performed as part of processes and procedures throughout the software life cycle.” It also says that attesting to ongoing processes is typically more valuable than making an assertion about one specific release.
-
Ask how the work will be verified
Ask which verification techniques are appropriate for your software and what evidence the company can share. Depending on the project, that might include records of reviews or test results; agree in advance on what is relevant and how results will be handled. NIST’s Software Verification guidance recommends incorporating applicable minimum verification techniques into supplier requirements.
-
Assign security ownership
Name who is responsible for defining security requirements, reviewing decisions, and coordinating remediation during the engagement. Clarify what the supplier owns and what remains your organization’s responsibility. Treat any certification or security label as a claim to examine, not a substitute for understanding the practices relevant to this project.
-
Examine vulnerability handling
Ask how the company receives vulnerability reports, assesses them, prioritizes fixes, and communicates status and resolution. Clarify how it responds when a vulnerability affects a third-party component or a supplier. CISA’s software acquisition materials include vulnerability-disclosure and incident-response processes in supplier assessment.
Recommended Free Tools
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Discuss software components
Ask how the company tracks third-party and open-source components, manages updates, and addresses known vulnerabilities. Where it fits the system and your needs, ask whether it can provide useful software bill of materials (SBOM) information. NIST identifies SBOMs, open-source controls, and vulnerability management as relevant software supply-chain topics.
-
Set rules for data and supplier safeguards
Identify what information the company and its suppliers will handle, where it will be used or stored if that matters to your obligations, and who may access it. Put applicable information-protection obligations into the agreement and address relevant supplier responsibilities. CISA’s small- and medium-sized-business vendor assessment materials include supplier obligations to protect information.
Test continuity and put the agreement to work
-
Plan for disruption
Ask what happens if a key supplier, team, service, or software component becomes unavailable. Discuss practical dependencies and how the company would communicate and respond. NIST’s due-diligence guide identifies supplier resilience as an area to assess.
-
Agree on change, review, and acceptance
Specify how either party can propose a scope change, how its impact will be agreed, who reviews deliverables, and how acceptance is recorded. Make the process fit your project rather than assuming a generic clause will resolve disputes.
Free tools Windows power users keep installed
One-click scans. No signup required.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Check that the contract matches the work
Review whether procurement documents and agreements state the relevant security expectations, supplier responsibilities, verification requirements, and vulnerability-handling arrangements. CISA’s acquisition guidance asks buyers to consider supplier agreements and security practices. For legal interpretation or jurisdiction-specific clauses, consult a qualified adviser; the cited U.S. guidance is not legal advice.
-
Ask for evidence behind important claims
For material promises, ask what applicable documents, process descriptions, or artifacts support them, and whether the evidence covers the work you are buying. Prefer evidence of practices sustained across the life cycle over a broad claim about one release. NIST’s attestation guidance emphasizes process-oriented, lifecycle-wide evidence.
Compare proposals without pretending there is a universal score
Use the same questions for every candidate and compare the substance of their answers. NIST and CISA guidance supports these evaluation dimensions, but does not establish validated weighting for selecting commercial software development companies.
- Relevant delivery experience for your problem and constraints
- Clarity of scope, deliverables, dependencies, and acceptance
- Transparency about the people and suppliers involved
- Secure-development practices and applicable verification evidence
- Vulnerability and incident handling
- Component and provenance information
- Plans for supplier or component disruption
- Specificity of contractual commitments and responsibilities
When an answer is vague, ask for a concrete example or an artifact that can be shared appropriately. If a proposal leaves a material responsibility, dependency, or security expectation unresolved, settle it before signing rather than treating an optimistic presentation as a commitment.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
