It covers both software an organization produces and software it consumes, from selecting upstream components through building, distributing, verifying, operating, and retiring releases.
The discipline combines secure development with governance of continuous integration and continuous delivery or deployment (CI/CD), dependencies, build provenance, attestations, signing, release approval, and incident response. Producers and consumers need verifiable evidence and enforceable policy, not merely inventories or assurances from upstream parties.
Key points
Upstream and sourceAssess dependencies and suppliers, constrain repository changes, protect developer identities, review contributions, and track components and known vulnerabilities throughout supported versions.
Build and releaseIsolate and harden build systems, minimize privileges, protect secrets, generate trustworthy provenance, sign artifacts, separate approvals, and secure registries and update channels.
Consumption and responseVerify origin and integrity before deployment, retain dependency and provenance records, monitor disclosures and compromise indicators, and prepare to replace, revoke, or rebuild affected software.
Important limitationA software bill of materials (SBOM), signature, provenance statement, or conformance level supplies bounded evidence, not proof that software is vulnerability-free or uncompromised. A valid artifact can come from an authorized but compromised build process.