# What is Software Supply-Chain Security?

> Software supply-chain security is the discipline of protecting source code, dependencies, development tools, identities, build and test systems, artifact repositories, release processes, and update channels against unauthorized or unsafe change.

- Canonical URL: https://yellowcube.eu/glossary/software-supply-chain-security/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It covers both software an organization produces and software it consumes, from selecting upstream components through building, distributing, verifying, operating, and retiring releases.

The discipline combines secure development with governance of continuous integration and continuous delivery or deployment (CI/CD), dependencies, build provenance, attestations, signing, release approval, and incident response. Producers and consumers need verifiable evidence and enforceable policy, not merely inventories or assurances from upstream parties.

### Key points

- **Upstream and source:** Assess dependencies and suppliers, constrain repository changes, protect developer identities, review contributions, and track components and known vulnerabilities throughout supported versions.
- **Build and release:** Isolate and harden build systems, minimize privileges, protect secrets, generate trustworthy provenance, sign artifacts, separate approvals, and secure registries and update channels.
- **Consumption and response:** Verify origin and integrity before deployment, retain dependency and provenance records, monitor disclosures and compromise indicators, and prepare to replace, revoke, or rebuild affected software.
- **Important limitation:** A software bill of materials (SBOM), signature, provenance statement, or conformance level supplies bounded evidence, not proof that software is vulnerability-free or uncompromised. A valid artifact can come from an authorized but compromised build process.

### Related terms

[Supply-chain security](<https://yellowcube.eu/glossary/supply-chain-security/>) · [Supply-chain attack](<https://yellowcube.eu/glossary/supply-chain-attack/>) · [Software bill of materials (SBOM)](<https://yellowcube.eu/glossary/software-bill-of-materials/>) · [Continuous integration and continuous delivery or deployment (CI/CD) pipeline security](<https://yellowcube.eu/glossary/continuous-integration-and-continuous-delivery-or-deployment-pipeline-security/>) · [Vulnerability management](<https://yellowcube.eu/glossary/vulnerability-management/>)

### Sources

[NIST SP 800-218, Secure Software Development Framework (SSDF) Version 1.1](https://csrc.nist.gov/pubs/sp/800/218/final) · [NIST SP 800-204D, Strategies for the Integration of Software Supply Chain Security in DevSecOps CI/CD Pipelines](https://csrc.nist.gov/pubs/sp/800/204/d/final) · [Supply-chain Levels for Software Artifacts (SLSA), Specification v1.2](https://slsa.dev/spec/v1.2/)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.