Building Security into the Business Acquisition Process
• SEI Report
Publisher
Software Engineering Institute
Abstract
This article presents the standard process for acquiring software products and services in business. It is based on the recommendations of the Agreement processes specified by the IEEE 12207 Standard. This standard presents the commonly accepted practices for ensuring a well-defined and persistent assurance process for acquired software. With the help of 12207, it is possible to integrate best practice in acquisition and supply into a single uniform approach. That approach will guarantee that security considerations will be a central part of product selection, monitoring, and acceptance. The ensuing set of policies and procedures provides rational control over all aspects of the process of securing acquired products. Properly followed, they will ensure an adequately secure software deliverable.
Cite This SEI Report
Shoemaker, D. (2013, July 2). Building Security into the Business Acquisition Process. Retrieved September 16, 2026, from https://www.sei.cmu.edu/library/building-security-into-the-business-acquisition-process/.
@techreport{shoemaker_2013,
author={Shoemaker, Dan},
title={Building Security into the Business Acquisition Process},
month={Jul},
year={2013},
institution={Software Engineering Institute, Carnegie Mellon University},
url={https://www.sei.cmu.edu/library/building-security-into-the-business-acquisition-process/},
note={Accessed: 2026-Sep-16}
}
Shoemaker, Dan. "Building Security into the Business Acquisition Process." Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, July 2, 2013. https://www.sei.cmu.edu/library/building-security-into-the-business-acquisition-process/.
D. Shoemaker, "Building Security into the Business Acquisition Process," Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, 2-Jul-2013 [Online]. Available: https://www.sei.cmu.edu/library/building-security-into-the-business-acquisition-process/. [Accessed: 16-Sep-2026].
Shoemaker, Dan. "Building Security into the Business Acquisition Process." Software Engineering Institute, Carnegie Mellon University, Software Engineering Institute, 2 Jul. 2013. https://www.sei.cmu.edu/library/building-security-into-the-business-acquisition-process/. Accessed 16 Sep. 2026.
Shoemaker, Dan. Building Security into the Business Acquisition Process. Software Engineering Institute. 2013. https://www.sei.cmu.edu/library/building-security-into-the-business-acquisition-process/