Which two validation methods does NIST name for supplier assurance, and what governs how rigorous the choice should be? Choose two.

Answer: A. Site visits and third-party assessments
D. Requisite certifications and self-attestation

SP 800-161r1 names requisite certifications, site visits, third-party assessments and self-attestation as acceptable validation methods, with the type and rigour commensurate with the criticality of the service or product acquired.

Source: NIST SP 800-161 Rev. 1 (NIST) — Sec. 3.1.2 The Role of C-SCRM in the Acquisition Process