Question 70

Attestation

Attestation refers to the act of formally providing evidence or proof to a customer that software developers have been trained in secure coding practices. This process often involves verification and documentation to reassure stakeholders about the security competence of the developers.

A) Assurance

Assurance generally refers to a level of confidence provided to stakeholders regarding a system's reliability and security. While closely related to attestation, it does not specifically denote the formal act of proving training in secure coding, making it less precise in this context.

B) Contract

A contract is a legal agreement between parties that outlines specific terms and conditions. While a contract may include clauses about secure coding practices, it does not inherently serve as proof of training or competence in those practices, thereby making it an incorrect choice.

C) Due diligence

Due diligence involves the investigation or exercise of care that a reasonable person undertakes before entering into an agreement or transaction. Although it can encompass checking for secure coding practices, it does not specifically constitute the act of providing proof of training, which is essential in this context.

D) Attestation

Attestation is the correct choice as it specifically involves the act of confirming and providing evidence that software developers have received training in secure coding. It is a formal process that ensures stakeholders are aware of the developers' qualifications and adherence to security standards.

Conclusion

Attestation is the only option that directly addresses the requirement of proving training in secure coding to customers. Other options, while related to the broader themes of assurance and security, do not specifically fulfill the precise need for formal proof of training, making them unsuitable in this context.