How to answer 'Do you perform automated software dependency scanning (SCA)?' on a CAIQ
I. Reviewer Guidance & Pitfalls
Name the SCA tool (e.g., Snyk, Dependabot, GitHub Security) and describe how high/critical CVEs in third-party libraries block CI/CD pull request merges.
II. Example Answer Passing Enterprise Audit
Compliant Response
Sealed · TVM-03
Yes. Automated Software Composition Analysis (SCA) scans all dependencies on every pull request. Builds containing unresolved critical vulnerabilities are automatically blocked from deployment (SOC 2, CC7.1).
Filling out a CAIQ or SIG Lite right now?
QuietQuestionnaire drafts answers with citations pulled directly from your own SOC 2 report, catches contradictions reviewers reject, and locks exports behind cryptographic human sign-off.
No spam · No credit card · Confidential by default