P‑SSCRM
The uniting framework for secure software supply chain risk management of code dependencies, build infrastructure, AI models and data, and the humans who maintain them.
Teams securing a software supply chain face a crowded field of standards — SSDF, SSDF-AI, SLSA, NIST 800-161, OWASP SCVS, and five more — with overlapping vocabulary and no single through-line. P-SSCRM is that through-line: one model of Groups, Practices, and Controls, each mapped back to the sources it came from, so you can work from a single checklist and still show alignment with the standards that apply to you.
Who P-SSCRM is for
New to P-SSCRM?
Start with what P-SSCRM is and why it exists.
What is P-SSCRM?Planning a program
See the whole model and where your gaps are.
The FrameworkDoing the work
Find the controls that map to your role.
Which controls apply to me?Assessing or researching
Use the controls and questions as an instrument.
Assessment questions
P-SSCRM Framework
5 Groups, 16 Practices, 78 Controls. Follow any cell into the framework.
Perform compliance 5 controls
Develop security policies 6 controls
Manage suppliers 5 controls
Training 3 controls
Assess and manage risk 4 controls
Develop security requirements 2 controls
Build security in 6 controls
Manage component and container choices 4 controls
Discover vulnerabilities 5 controls
Manage vulnerable components and containers 2 controls
Safeguard artifact integrity 6 controls
Safeguard build integrity 8 controls
Secure software development environment 10 controls
- E.3.1 Authentication
- E.3.2 Environmental separation
- E.3.3 Role-based access control
- E.3.4 Information flow enforcement
- E.3.5 Baseline configuration
- E.3.6 Monitor changes to configuration settings
- E.3.7 Boundary protection
- E.3.8 Key rotation
- E.3.9 Ephemeral credentials
- E.3.10 Establish a root of trust
Respond to/disclose vulnerabilities 5 controls
Monitor intrusions/violations 2 controls
Identify SSC Control Gaps 5 controls
How it relates to what you already use
P-SSCRM is a uniting framework: every control maps to one or more established government and industry standards, including EO, 800-161, SSDF, SLSA, BSIMM, CNCF-SSC, and more.
See all contributing standards and which controls cite each one →
Each P-SSCRM control is also mapped to the MITRE ATT&CK technique(s) it mitigates. See how the ATT&CK mapping works →
News
Background & citation
P-SSCRM was built by unifying the common ground across the field's government and industry initiatives and standards. It is described in a paper on arXiv and stewarded with the S3C2 research center.
P-SSCRM v1.0 · Baseline study · S3C2 · Full background
Current framework data: v2.0 (JSON). MITRE ATT&CK mapping: v1.1. Data comes from p-sscrm/p-sscrm and p-sscrm/ats-to-ts.
Put P-SSCRM to work
Read the framework, work through the assessment questions for your Groups and Practices, or help shape P-SSCRM by joining the interview study.