P‑SSCRM
One framework for managing software supply chain risk: your code dependencies, build systems, AI models and data, and the people who maintain them.
Securing a software supply chain means working with many standards — SSDF, SSDF-AI, SLSA, NIST 800-161, OWASP SCVS, and five more — that overlap and use different terms. P-SSCRM brings them together in one model of Groups, Practices, and Controls. Each control points back to the standards it came from, so you can work from a single checklist and still show you meet the standards that apply to you.
Who P-SSCRM is for
New to P-SSCRM?
Start with what P-SSCRM is and why it exists.
What is P-SSCRM?Planning a program
See the whole model and where your gaps are.
The FrameworkDoing the work
Find the controls that map to your role.
Which controls apply to me?Assessing or researching
Use the controls and questions to assess or study a program.
Self-assessment
P-SSCRM Framework
5 Groups, 16 Practices, 78 Controls. Select any cell to explore it.
Perform compliance 5 controls
Develop security policies 6 controls
Manage suppliers 5 controls
Training 3 controls
Assess and manage risk 4 controls
Develop security requirements 2 controls
Build security in 6 controls
Manage component and container choices 4 controls
Discover vulnerabilities 5 controls
Manage vulnerable components and containers 2 controls
Safeguard artifact integrity 6 controls
Safeguard build integrity 8 controls
Secure software development environment 10 controls
- E.3.1 Authentication
- E.3.2 Environmental separation
- E.3.3 Role-based access control
- E.3.4 Information flow enforcement
- E.3.5 Baseline configuration
- E.3.6 Monitor changes to configuration settings
- E.3.7 Boundary protection
- E.3.8 Key rotation
- E.3.9 Ephemeral credentials
- E.3.10 Establish a root of trust
Respond to/disclose vulnerabilities 5 controls
Monitor intrusions/violations 2 controls
Identify SSC Control Gaps 5 controls
How it relates to what you already use
Every P-SSCRM control maps to one or more established government and industry standards, including EO, 800-161, SSDF, SLSA, BSIMM, CNCF-SSC, and more.
See all the standards and which controls draw on each one →
Each control is also linked to the MITRE ATT&CK attack techniques it helps defend against. See how the ATT&CK mapping works →
News
Background & citation
P-SSCRM combines the common ground of the field's government and industry standards. It is described in a paper on arXiv and run with the S3C2 research center.
P-SSCRM v1.0 · Baseline study · S3C2 · Full background
Current framework data: v2.0 (JSON). MITRE ATT&CK mapping: v1.1. Data comes from p-sscrm/p-sscrm and p-sscrm/ats-to-ts.
Put P-SSCRM to work
Read the framework, work through the assessment questions for your Groups and Practices, or help shape P-SSCRM by taking part in an interview-based assessment.