Blockchain Transaction Lifecycle Security Standard Audit Framework

previous: Verify Received Transactions | Contents | next: Document Cryptography Migration Procedures

Manage a Secure Software Supply Chain

Statement of Requirement

All Actors MUST maintain a secure Software supply chain, including:

• version pinning,
• logged formal approval process for accepting software updates,
• maintain documentation of the Actor's full Software Bill Of Materials (SBOM)

See it in the specification

Applicability

All Roles

Purpose

Manage software supply chain attack surfaces

Audit Procedure

Verify that

• documentation provided includes a complete Software Bill of Materials
• there is logged approval to adopt each component of the full SBOM, and every change made during the previous 12 months
• removing software is treated as a change requiring sign-off
• all software used by the Actor is version-pinned

Success Criteria

• The Actor has a complete and accurate Software Bill of Materials (SBOM)
• The documented supply chain has been formally approved
• Every change to the documented supply chain, including the removal of a component, is covered by a change request signed off before the change reached production

Best Practice

• The Software Bill of Materials describes, for each item, a threat assessment, and procedures for and implications of replacing the item
• The actor has real-time threat intelligence monitoring for each item in the SBOM, and their known dependencies
• The Actor minimizes their SBOM to software that is necessary for their operations

Failure Criteria

• An actor makes use of a piece of software that is not documented in the SBOM
• The documented supply chain has never been formally approved
• A component was added, replaced, or removed in production and the documentation was updated to match, with no approval process followed

Key Evidence

• System documentation
• Approval records for the documented supply chain
• Change request records, which may be code review or pull request records
• Interview and Inspection

previous: Verify Received Transactions | Contents | next: Document Cryptography Migration Procedures