Design software supply chain security standards
Implementation Effort: Medium – Writing organization-wide standards for SBOMs, artifact signing, provenance, and dependency governance requires input from multiple product and platform teams to agree on a workable baseline. User Impact: Low – Authoring the standards is a governance activity for security and engineering leaders; developers are not prompted when the standards are published. Lifecycle Stage: Govern
Overview
Design and publish organization-wide software supply chain security standards that define requirements for SBOM generation, artifact signing, provenance capture, and dependency governance across the delivery lifecycle. These standards create a consistent minimum baseline for every team and product.
Software supply chain attacks target the components, tools, and processes that produce software rather than only the running application. Organizational standards should define how software is inventoried through SBOMs, how artifacts are signed and verified, how provenance metadata is captured, and how dependencies are approved, updated, and retired. The standards should also make platform differences explicit—for example, whether GitHub artifact attestations, Azure signing and verification controls, or Azure DevOps pipeline patterns are used in different parts of the environment.
Without explicit standards, teams make independent and often inconsistent choices about whether to generate SBOMs, which signing tools to use, or whether to verify provenance at all. Defined standards close those gaps by establishing a minimum security bar across all teams. This directly supports Verify explicitly because every artifact should carry machine-readable evidence of what it contains, where it was built, and who authorized its release. It also supports Assume breach by preparing the organization to answer incident-response questions quickly when a dependency, build system, or artifact repository is compromised.