You aren’t expected to do anything in analysis and mitigation for SOUP that you shouldn’t already be doing for all of your own software. The point is you can’t

You aren’t expected to do anything in analysis and mitigation for SOUP that you shouldn’t already be doing for all of your own software. The point is you can’t just punt on that stuff when you use others software. It doesnt have to be that onerous, but you do need to put some thought into it.