ATT&CK Mapping
Each P-SSCRM control is mapped to the MITRE ATT&CK technique(s) it mitigates. Because every control is already cross-referenced to the government and industry standards on Standards & Frameworks, this mapping also connects ATT&CK techniques to those ten standards — SSDF, SLSA, BSIMM, NIST 800-161, and the rest — through P-SSCRM.
The mapping is described in Your ATs to Ts: MITRE ATT&CK Attack Technique to P-SSCRM Task Mapping (Hamer, Bowen, Haque, Wroblewski, Madden, and Williams), available at arxiv.org/abs/2507.18037. It builds on the gaps identified in Closing the Chain, which analyzed the SolarWinds, Log4j, and XZ Utils attacks against ten existing security frameworks to find where those frameworks fall short.
How the mapping was developed
The mapping team worked from the ATT&CK techniques observed or plausible in software supply chain attacks and matched each one to the P-SSCRM controls that mitigate it. Four independent strategies were used to propose candidate mappings — including keyword and technique-description matching and manual analysis grounded in real supply chain incidents — and only the mappings the strategies agreed on were kept. That is the same approach the Closing the Chain paper used to check frameworks against real attacks, applied here to build a mapping instead of an evaluation.
ATT&CK techniques
Techniques used or plausible in software supply chain attacks such as SolarWinds, Log4j, and XZ Utils.
Four independent strategies
Separate passes — keyword matching, technique-description matching, and manual, incident-grounded analysis — each propose candidate control–technique pairs.
Agreed-upon mapping
Only pairs the strategies agree on are kept, producing the reconciled mapping.
P-SSCRM controls
Each technique is attached to the control(s) that mitigate it — and, through those controls, to the ten standards they already cite.
From control, to technique, to standard
Because P-SSCRM controls already cite standards like BSIMM and the CNCF Software Supply Chain Best Practices, adding the ATT&CK mapping gives a three-way link. P.3.3, “Require signed commits” mitigates a single technique and cites two standards, so the whole chain fits in one diagram:
See a control’s ATT&CK mapping directly
Every control’s entry on The Framework lists the ATT&CK technique(s) it mitigates, next to its standard mappings. A few examples, technique shown alongside each:
- P.3.3 — Require signed commits T1554
- P.4.1 — Security code review T1195
- D.1.6 — Root cause analysis T1195
Or open The Framework and expand any control to see its mapping.
From technique back to controls
The mapping also runs in reverse: pick an ATT&CK technique below to see every P-SSCRM control that mitigates it, grouped by Practice. Search to find a specific technique or control.
Bar colours: Governance Product Environment Deployment — hover a bar for exact counts
No techniques match that search.
136 ATT&CK techniques are mapped. Click one to open it, or search to find a specific one.
T1001 1
E.3 Secure software development environment
E.3.7 — Boundary protectionT1003 2
E.3 Secure software development environment
E.3.3 — Role-based access controlD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1005 1
G.2 Develop security policies
G.2.6 — Protection of information at restT1007 1
P.2 Build security in
P.2.1 — Security design reviewT1008 1
E.3 Secure software development environment
E.3.7 — Boundary protectionT1012 1
D.2 Monitor intrusions/violations
D.2.1 — System monitoringT1014 3
E.2 Safeguard build integrity
E.2.6 — Reproducible buildsE.3 Secure software development environment
E.3.6 — Monitor changes to configuration settings E.3.10 — Establish a root of trustT1016 1
D.2 Monitor intrusions/violations
D.2.1 — System monitoringT1018 1
D.2 Monitor intrusions/violations
D.2.1 — System monitoringT1021 3
E.3 Secure software development environment
E.3.3 — Role-based access control E.3.7 — Boundary protectionD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1025 1
G.2 Develop security policies
G.2.6 — Protection of information at restT1027 2
D.2 Monitor intrusions/violations
D.2.1 — System monitoringU.1 Identify SSC Control Gaps
E.3.11 — Development Environment Scanning ToolsT1033 1
P.2 Build security in
P.2.1 — Security design reviewT1036 3
E.3 Secure software development environment
E.3.3 — Role-based access controlD.2 Monitor intrusions/violations
D.2.1 — System monitoringU.1 Identify SSC Control Gaps
E.3.11 — Development Environment Scanning ToolsT1040 2
E.3 Secure software development environment
E.3.2 — Environmental separation E.3.4 — Information flow enforcementT1041 3
G.2 Develop security policies
G.2.6 — Protection of information at restE.3 Secure software development environment
E.3.7 — Boundary protectionD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1046 2
P.2 Build security in
P.2.1 — Security design reviewE.3 Secure software development environment
E.3.7 — Boundary protectionT1047 2
E.3 Secure software development environment
E.3.3 — Role-based access control E.3.7 — Boundary protectionT1048 2
G.2 Develop security policies
G.2.6 — Protection of information at restE.3 Secure software development environment
E.3.7 — Boundary protectionT1049 1
D.2 Monitor intrusions/violations
D.2.1 — System monitoringT1052 1
G.2 Develop security policies
G.2.6 — Protection of information at restT1053 6
G.3 Manage suppliers
G.3.4 — Session auditsP.2 Build security in
P.2.1 — Security design reviewE.3 Secure software development environment
E.3.3 — Role-based access control E.3.6 — Monitor changes to configuration settingsD.2 Monitor intrusions/violations
D.2.1 — System monitoring D.2.2 — Build process monitoringT1055 6
P.4 Discover vulnerabilities
P.4.4 — Executable security testingE.3 Secure software development environment
E.3.3 — Role-based access control E.3.7 — Boundary protection E.3.10 — Establish a root of trustD.2 Monitor intrusions/violations
D.2.1 — System monitoring D.2.2 — Build process monitoringT1056 3
G.3 Manage suppliers
G.3.4 — Session auditsE.1 Safeguard artifact integrity
E.1.3 — Multi-factor authentication (MFA)E.3 Secure software development environment
E.3.1 — AuthenticationT1057 1
D.2 Monitor intrusions/violations
D.2.1 — System monitoringT1059 3
E.3 Secure software development environment
E.3.3 — Role-based access control E.3.6 — Monitor changes to configuration settingsD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1068 5
G.4 Training
G.4.3 — Gather attack trendsP.5 Manage vulnerable components and containers
P.5.2 — Dependency updateE.2 Safeguard build integrity
E.2.5 — Secured orchestration platformE.3 Secure software development environment
E.3.3 — Role-based access controlD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1070 1
D.2 Monitor intrusions/violations
D.2.1 — System monitoringT1071 2
E.3 Secure software development environment
E.3.7 — Boundary protectionD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1072 7
G.5 Assess and manage risk
G.5.2 — Track security risks and decisionsP.5 Manage vulnerable components and containers
P.5.2 — Dependency updateE.1 Safeguard artifact integrity
E.1.5 — Branch protectionE.2 Safeguard build integrity
E.2.5 — Secured orchestration platformE.3 Secure software development environment
E.3.2 — Environmental separation E.3.3 — Role-based access control E.3.7 — Boundary protectionT1078 7
G.4 Training
G.4.1 — Role-based trainingE.1 Safeguard artifact integrity
E.1.3 — Multi-factor authentication (MFA)E.3 Secure software development environment
E.3.2 — Environmental separation E.3.3 — Role-based access control E.3.8 — Key rotation E.3.9 — Ephemeral credentialsD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1080 4
E.3 Secure software development environment
E.3.3 — Role-based access control E.3.7 — Boundary protectionD.2 Monitor intrusions/violations
D.2.1 — System monitoringU.1 Identify SSC Control Gaps
E.3.11 — Development Environment Scanning ToolsT1082 1
D.2 Monitor intrusions/violations
D.2.1 — System monitoringT1083 1
D.2 Monitor intrusions/violations
D.2.1 — System monitoringT1090 1
E.3 Secure software development environment
E.3.7 — Boundary protectionT1095 1
E.3 Secure software development environment
E.3.7 — Boundary protectionT1098 4
E.1 Safeguard artifact integrity
E.1.3 — Multi-factor authentication (MFA)E.3 Secure software development environment
E.3.3 — Role-based access control E.3.6 — Monitor changes to configuration settingsU.1 Identify SSC Control Gaps
E.3.11 — Development Environment Scanning ToolsT1102 1
E.3 Secure software development environment
E.3.7 — Boundary protectionT1104 1
E.3 Secure software development environment
E.3.7 — Boundary protectionT1105 2
E.3 Secure software development environment
E.3.7 — Boundary protectionD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1110 1
E.3 Secure software development environment
E.3.3 — Role-based access controlT1112 2
E.3 Secure software development environment
E.3.3 — Role-based access control E.3.6 — Monitor changes to configuration settingsT1114 2
E.3 Secure software development environment
E.3.4 — Information flow enforcement E.3.6 — Monitor changes to configuration settingsT1119 3
G.2 Develop security policies
G.2.6 — Protection of information at restE.3 Secure software development environment
E.3.4 — Information flow enforcementD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1127 1
P.2 Build security in
P.2.1 — Security design reviewT1129 1
D.2 Monitor intrusions/violations
D.2.1 — System monitoringT1132 2
E.3 Secure software development environment
E.3.7 — Boundary protectionD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1133 1
E.3 Secure software development environment
E.3.7 — Boundary protectionT1134 1
E.3 Secure software development environment
E.3.3 — Role-based access controlT1136 1
E.3 Secure software development environment
E.3.3 — Role-based access controlT1140 1
D.2 Monitor intrusions/violations
D.2.1 — System monitoringT1176 3
E.3 Secure software development environment
E.3.6 — Monitor changes to configuration settings E.3.7 — Boundary protectionD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1185 1
E.3 Secure software development environment
E.3.3 — Role-based access controlT1187 1
E.3 Secure software development environment
E.3.7 — Boundary protectionT1189 2
E.3 Secure software development environment
E.3.7 — Boundary protectionD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1190 16
G.2 Develop security policies
G.2.5 — Asset inventoryG.4 Training
G.4.1 — Role-based trainingG.5 Assess and manage risk
G.5.1 — Criticality analysisP.4 Discover vulnerabilities
P.4.3 — Automated vulnerability detection P.4.4 — Executable security testingP.5 Manage vulnerable components and containers
P.5.2 — Dependency updateE.2 Safeguard build integrity
E.2.4 — CI/CD hosting and automation E.2.5 — Secured orchestration platformE.3 Secure software development environment
E.3.2 — Environmental separation E.3.3 — Role-based access control E.3.7 — Boundary protectionD.1 Respond to/disclose vulnerabilities
D.1.2 — Risk-based vulnerability remediation D.1.3 — Vulnerability disclosureD.2 Monitor intrusions/violations
D.2.1 — System monitoringU.1 Identify SSC Control Gaps
E.3.11 — Development Environment Scanning Tools D.1.7 — Establish Response PartnershipsT1195 21
G.1 Perform compliance
G.1.4 — Deliver provenance G.1.5 — Deliver SBOMG.3 Manage suppliers
G.3.1 — Security-related contract termsG.4 Training
G.4.1 — Role-based training G.4.3 — Gather attack trendsG.5 Assess and manage risk
G.5.1 — Criticality analysisP.2 Build security in
P.2.1 — Security design reviewP.3 Manage component and container choices
P.3.4 — Vetted third-party component and container repositoriesP.4 Discover vulnerabilities
P.4.1 — Security code review P.4.3 — Automated vulnerability detection P.4.5 — Regular third-party complianceP.5 Manage vulnerable components and containers
P.5.1 — SBOM consumption P.5.2 — Dependency updateD.1 Respond to/disclose vulnerabilities
D.1.2 — Risk-based vulnerability remediation D.1.3 — Vulnerability disclosure D.1.4 — Vulnerability eradication D.1.6 — Root cause analysisD.2 Monitor intrusions/violations
D.2.1 — System monitoringU.1 Identify SSC Control Gaps
G.5.5 — Support Upstream Dependencies E.3.11 — Development Environment Scanning Tools D.1.7 — Establish Response PartnershipsT1199 7
G.5 Assess and manage risk
G.5.1 — Criticality analysisP.2 Build security in
P.2.1 — Security design reviewE.3 Secure software development environment
E.3.3 — Role-based access control E.3.7 — Boundary protectionU.1 Identify SSC Control Gaps
G.5.5 — Support Upstream Dependencies E.3.11 — Development Environment Scanning Tools D.1.7 — Establish Response PartnershipsT1203 2
E.3 Secure software development environment
E.3.7 — Boundary protectionD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1204 1
E.3 Secure software development environment
E.3.7 — Boundary protectionT1205 1
E.3 Secure software development environment
E.3.7 — Boundary protectionT1210 7
G.4 Training
G.4.3 — Gather attack trendsP.2 Build security in
P.2.1 — Security design reviewP.4 Discover vulnerabilities
P.4.3 — Automated vulnerability detectionP.5 Manage vulnerable components and containers
P.5.2 — Dependency updateE.3 Secure software development environment
E.3.3 — Role-based access control E.3.7 — Boundary protectionD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1211 4
G.4 Training
G.4.3 — Gather attack trendsP.5 Manage vulnerable components and containers
P.5.2 — Dependency updateE.2 Safeguard build integrity
E.2.5 — Secured orchestration platformD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1212 5
G.4 Training
G.4.3 — Gather attack trendsP.5 Manage vulnerable components and containers
P.5.2 — Dependency updateE.2 Safeguard build integrity
E.2.5 — Secured orchestration platformE.3 Secure software development environment
E.3.7 — Boundary protectionD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1213 4
G.2 Develop security policies
G.2.6 — Protection of information at restE.3 Secure software development environment
E.3.3 — Role-based access control E.3.4 — Information flow enforcementD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1218 2
E.3 Secure software development environment
E.3.3 — Role-based access controlD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1219 1
E.3 Secure software development environment
E.3.7 — Boundary protectionT1221 3
P.2 Build security in
P.2.1 — Security design reviewE.3 Secure software development environment
E.3.7 — Boundary protectionU.1 Identify SSC Control Gaps
E.3.11 — Development Environment Scanning ToolsT1222 1
E.3 Secure software development environment
E.3.3 — Role-based access controlT1482 2
E.3 Secure software development environment
E.3.2 — Environmental separationD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1484 3
E.3 Secure software development environment
E.3.3 — Role-based access control E.3.6 — Monitor changes to configuration settingsD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1486 2
E.3 Secure software development environment
E.3.3 — Role-based access controlD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1489 1
E.3 Secure software development environment
E.3.3 — Role-based access controlT1490 3
E.3 Secure software development environment
E.3.3 — Role-based access control E.3.6 — Monitor changes to configuration settingsD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1496 2
E.3 Secure software development environment
E.3.3 — Role-based access controlD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1497 1
D.2 Monitor intrusions/violations
D.2.1 — System monitoringT1499 3
E.3 Secure software development environment
E.3.7 — Boundary protectionD.1 Respond to/disclose vulnerabilities
D.1.2 — Risk-based vulnerability remediationD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1505 4
P.2 Build security in
P.2.1 — Security design reviewP.4 Discover vulnerabilities
P.4.5 — Regular third-party complianceE.3 Secure software development environment
E.3.3 — Role-based access control E.3.6 — Monitor changes to configuration settingsT1518 1
D.2 Monitor intrusions/violations
D.2.1 — System monitoringT1525 2
E.3 Secure software development environment
E.3.3 — Role-based access control E.3.6 — Monitor changes to configuration settingsT1528 2
E.3 Secure software development environment
E.3.3 — Role-based access controlD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1530 3
G.2 Develop security policies
G.2.6 — Protection of information at restE.3 Secure software development environment
E.3.3 — Role-based access control E.3.4 — Information flow enforcementT1537 2
E.3 Secure software development environment
E.3.3 — Role-based access control E.3.7 — Boundary protectionT1538 1
E.3 Secure software development environment
E.3.3 — Role-based access controlT1543 2
E.3 Secure software development environment
E.3.6 — Monitor changes to configuration settingsD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1546 4
E.3 Secure software development environment
E.3.1 — Authentication E.3.3 — Role-based access controlD.2 Monitor intrusions/violations
D.2.1 — System monitoring D.2.2 — Build process monitoringT1547 1
D.2 Monitor intrusions/violations
D.2.1 — System monitoringT1548 3
E.3 Secure software development environment
E.3.3 — Role-based access control E.3.6 — Monitor changes to configuration settingsD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1550 4
G.3 Manage suppliers
G.3.4 — Session auditsE.3 Secure software development environment
E.3.3 — Role-based access control E.3.6 — Monitor changes to configuration settingsD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1552 7
G.2 Develop security policies
G.2.6 — Protection of information at restE.3 Secure software development environment
E.3.3 — Role-based access control E.3.4 — Information flow enforcement E.3.6 — Monitor changes to configuration settings E.3.7 — Boundary protection E.3.8 — Key rotationD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1553 6
P.2 Build security in
P.2.1 — Security design reviewP.4 Discover vulnerabilities
P.4.5 — Regular third-party complianceP.5 Manage vulnerable components and containers
P.5.2 — Dependency updateE.3 Secure software development environment
E.3.3 — Role-based access controlD.1 Respond to/disclose vulnerabilities
D.1.2 — Risk-based vulnerability remediation D.1.4 — Vulnerability eradicationT1554 1
P.3 Manage component and container choices
P.3.3 — Require signed commitsT1555 2
E.3 Secure software development environment
E.3.3 — Role-based access controlD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1556 3
E.3 Secure software development environment
E.3.3 — Role-based access control E.3.6 — Monitor changes to configuration settingsD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1557 3
E.3 Secure software development environment
E.3.2 — Environmental separation E.3.4 — Information flow enforcement E.3.7 — Boundary protectionT1558 3
E.3 Secure software development environment
E.3.3 — Role-based access control E.3.8 — Key rotationD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1559 1
P.2 Build security in
P.2.1 — Security design reviewT1560 2
G.3 Manage suppliers
G.3.4 — Session auditsD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1562 3
E.3 Secure software development environment
E.3.6 — Monitor changes to configuration settingsD.1 Respond to/disclose vulnerabilities
D.1.2 — Risk-based vulnerability remediationD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1563 2
E.3 Secure software development environment
E.3.2 — Environmental separation E.3.3 — Role-based access controlT1564 1
U.1 Identify SSC Control Gaps
E.3.11 — Development Environment Scanning ToolsT1565 3
G.2 Develop security policies
G.2.6 — Protection of information at restE.3 Secure software development environment
E.3.3 — Role-based access control E.3.4 — Information flow enforcementT1566 1
E.3 Secure software development environment
E.3.7 — Boundary protectionT1567 1
E.3 Secure software development environment
E.3.7 — Boundary protectionT1568 2
E.3 Secure software development environment
E.3.7 — Boundary protectionD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1569 1
E.3 Secure software development environment
E.3.3 — Role-based access controlT1570 1
E.3 Secure software development environment
E.3.7 — Boundary protectionT1571 1
E.3 Secure software development environment
E.3.7 — Boundary protectionT1572 1
E.3 Secure software development environment
E.3.7 — Boundary protectionT1573 2
E.3 Secure software development environment
E.3.7 — Boundary protectionD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1574 2
E.3 Secure software development environment
E.3.6 — Monitor changes to configuration settingsD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1578 1
E.3 Secure software development environment
E.3.3 — Role-based access controlT1584 1
U.1 Identify SSC Control Gaps
E.3.11 — Development Environment Scanning ToolsT1585 1
E.3 Secure software development environment
E.3.3 — Role-based access controlT1586 7
G.3 Manage suppliers
G.3.4 — Session auditsE.1 Safeguard artifact integrity
E.1.3 — Multi-factor authentication (MFA) E.1.4 — Developer SSH keyE.3 Secure software development environment
E.3.1 — Authentication E.3.3 — Role-based access control E.3.9 — Ephemeral credentialsD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1587 3
G.4 Training
G.4.3 — Gather attack trendsG.5 Assess and manage risk
G.5.1 — Criticality analysisP.2 Build security in
P.2.1 — Security design reviewT1588 1
G.4 Training
G.4.3 — Gather attack trendsT1589 1
G.3 Manage suppliers
G.3.4 — Session auditsT1591 1
G.3 Manage suppliers
G.3.4 — Session auditsT1593 1
G.4 Training
G.4.1 — Role-based trainingT1595 2
G.4 Training
G.4.3 — Gather attack trendsD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1599 1
E.3 Secure software development environment
E.3.7 — Boundary protectionT1602 2
E.3 Secure software development environment
E.3.4 — Information flow enforcement E.3.7 — Boundary protectionT1606 3
G.3 Manage suppliers
G.3.4 — Session auditsE.3 Secure software development environment
E.3.3 — Role-based access controlD.2 Monitor intrusions/violations
D.2.1 — System monitoringT1608 1
U.1 Identify SSC Control Gaps
E.3.11 — Development Environment Scanning ToolsT1609 2
P.2 Build security in
P.2.1 — Security design reviewE.3 Secure software development environment
E.3.3 — Role-based access controlT1610 3
E.3 Secure software development environment
E.3.3 — Role-based access control E.3.6 — Monitor changes to configuration settings E.3.7 — Boundary protectionT1611 2
P.2 Build security in
P.2.1 — Security design reviewE.3 Secure software development environment
E.3.7 — Boundary protectionT1612 2
P.4 Discover vulnerabilities
P.4.5 — Regular third-party complianceE.3 Secure software development environment
E.3.6 — Monitor changes to configuration settingsT1621 1
E.3 Secure software development environment
E.3.3 — Role-based access controlT1622 1
D.2 Monitor intrusions/violations
D.2.1 — System monitoringT1649 1
E.3 Secure software development environment
E.3.3 — Role-based access controlT1651 1
E.3 Secure software development environment
E.3.3 — Role-based access controlT1656 2
T1659 2
E.3 Secure software development environment
E.3.4 — Information flow enforcement E.3.7 — Boundary protectionT1665 2
E.3 Secure software development environment
E.3.7 — Boundary protectionD.2 Monitor intrusions/violations
D.2.1 — System monitoring