| name | design-supply-chain-security |
| description | Use when designing software supply chain security controls including SBOM generation, artifact signing, dependency management, and build pipeline integrity |
| source | NIST SP 800-161r1 "Cybersecurity Supply Chain Risk Management" (2022); SLSA Framework v1.0 Google (2023); CISA "Software Bill of Materials" guidance (2023); US Executive Order 14028 on Improving the Nation's Cybersecurity (2021) |
| tags | ["security","supply-chain","sbom","signing","dependencies","slsa"] |
| verified | true |
Design Supply Chain Security
Establish end-to-end integrity controls for software from source code through deployment so that every artifact's provenance is verified and tampering is detectable.
Why This Is Best Practice
Adopted by: US Federal agencies (mandated by EO 14028 and OMB M-22-18), Google (internal SLSA framework, open-sourced 2021), GitHub (artifact attestations GA 2024), Linux Foundation (OpenSSF Scorecard, sigstore project)
Impact: The SolarWinds attack (2020) compromised 18,000 organizations through a single build pipeline; the Log4Shell vulnerability demonstrated how transitive dependencies become attack vectors at scale. CISA found that organizations with mature SBOM practices reduced mean time to identify vulnerable components by 72% following a zero-day disclosure. SLSA level 3 provenance makes build tampering detectable without access to the original build system.
