How do you assess and qualify SOUP suppliers, and how do you determine their criticality?

Question

Do you assess and qualify suppliers of SOUP (Software of Unknown Provenance)? For example, some SOUP items like cloud infrastructure can directly impact product safety and performance and are included on our approved supplier list, but other SOUP items like programming languages and libraries seem to fall into a grey area. How do you categorize the criticality of different SOUP items, and what is your approach to supplier qualification and control for these?
Thank you in advance!

Dr. Oliver Eidel · Accepted Answer

In our implementation, SOUP suppliers are not added to the main supplier list. Instead, our supplier selection procedure describes how we control suppliers, including SOUP suppliers. Each SOUP item is controlled individually, and we perform reviews when upgrading SOUP items (for example, security reviews on the SOUP supplier).
Similarly, suppliers of tools aren't always handled through the supplier selection process, but the tools themselves are controlled and this approach is also explained in our procedure.
If a tool or SOUP item is custom-made for us, or adapted specifically for our use, then we formally select and monitor that supplier.

Answer

This is a tricky topic. In our case, we chose not to include cloud infrastructure in our SOUP list because these services don't have version numbers like typical software components. Instead, we treat cloud infrastructure more like a utility provider (e.g., electricity)—it's critical, but not versioned as a software dependency.

Answer

We initially listed SOUP suppliers in our supplier list, but during an audit we learned this isn't necessary. As long as you have sufficient control over your SOUP items (e.g., evaluating them during PMS activities), that's considered adequate. Our approach is simple—we control SOUPs via tools like dependabot on git and npm audit, though our documentation for this could be better.

How do you assess and qualify SOUP suppliers, and how do you determine their criticality?

3 Answers

Related resources

How to document SOUP for IEC 62304 compliance?

SOUP List (Software of Unknown Provenance)

QT9 QMS