Which two acquisition practices does NIST name for managing supply chain risk? Choose two.

Answer: A. Establishing a checklist of security requirements completed as part of procurement requests
D. Obtaining open source software only from vetted and approved libraries

SP 800-161r1 names practices including a checklist of acquisition security requirements for procurement requests, due diligence on bidders, obtaining open source from vetted and approved libraries, an approved products list, and a prohibited supplier list.

Source: NIST SP 800-161 Rev. 1 (NIST) — Sec. 3.1.1 Acquisition in the C-SCRM Strategy