P‑SSCRM Proactive Secure Software Supply Chain Risk Management

What is P-SSCRM?

What P-SSCRM is

P-SSCRM (Proactive Secure Software Supply Chain Risk Management) is a framework for managing software supply chain security risk. It organizes the work into Groups — Governance, Product, Environment, and Deployment, plus an Unassigned holding group for controls identified but not yet tied to a standard — each broken into Practices and then into concrete Controls. Every control states an objective, a fuller definition, a set of assessment questions, and a mapping to the established standards it draws from.

The problem it solves

Teams trying to secure a software supply chain face a crowded field of government and industry guidance — SSDF, SLSA, BSIMM, CNCF, OpenSSF, NIST 800-161, Executive Order 14028, and more — with overlapping vocabulary and no single through-line. P-SSCRM was built to be that through-line: a single model whose controls are cross-referenced to those sources, so a team can work from one checklist and still show alignment with the standards that apply to them.

How it was built

P-SSCRM v1.0 was authored by Laurie Williams, Sammy Migues, Jamie Boote, and Ben Hutchison.

P-SSCRM was assembled by analyzing the contributing standards and frameworks listed under Standards & Frameworks, identifying the common practices across them, and expressing each as a control with an explicit back-mapping. The framework definition and its mappings are maintained in the open at github.com/p-sscrm/p-sscrm; the MITRE ATT&CK technique mappings are maintained at github.com/p-sscrm/ats-to-ts. This site is generated from those repositories.

P-SSCRM lifecycle model by role: Practices A to O placed along the software lifecycle from internally developed source through build, package, deploy, run and retire, coloured by the role responsible.
The P-SSCRM lifecycle model by role: where each Practice applies across the software lifecycle, and which role owns it.

Who it’s for

Citing P-SSCRM

P-SSCRM is described in the paper P-SSCRM: Proactive Secure Software Supply Chain Risk Management, available at arxiv.org/abs/2404.12300. Please cite that paper and link to this site.

Who maintains it

P-SSCRM is stewarded by researchers at NC State University in collaboration with the Secure Software Supply Chain Center (S3C2). For questions or corrections, see Contact.

We welcome the participation and collaboration of all other interested parties.

License

P-SSCRM is licensed under a Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0) license. See github.com/p-sscrm/p-sscrm for the framework content. This website’s code is in the site repository.

Version history

Only the version marked current should be used for new compliance work; earlier versions are kept for reference. Data comes directly from p-sscrm/p-sscrm and p-sscrm/ats-to-ts.

Framework

MITRE ATT&CK mapping