How does GAS support compliance across a software supply chain?

• A. By providing SBOMs, dependency risk insights, and an auditable security process including advisories and vulnerability management.
• B. By printing compliance certificates for each release.
• C. By restricting all third-party libraries to a single vendor.
• D. By minimizing reporting and hiding vulnerabilities.

Answer: (A)

GAS supports compliance across the software supply chain by providing visibility into what components are used, how risky those components are, and a traceable security workflow. It generates Software Bill of Materials (SBOMs), which list every component, library, and license in a release, enabling you to verify exactly what’s included and to demonstrate compliance during audits. It also offers dependency risk insights that flag known vulnerabilities, outdated components, and exposure levels, helping teams prioritize remediation and reduce supply-chain risk. In addition, GAS establishes an auditable security process with advisories and vulnerability management, creating records of identified issues, remediation steps, and approval workflows that auditors can review. Together, these elements give the transparency, risk visibility, and traceability needed to maintain compliance across complex software supply chains and across multiple teams and vendors.

Printing compliance certificates, restricting to a single vendor, or hiding vulnerabilities do not provide the same level of visibility, governance, or trust essential for compliance in a software supply chain.