Software Supply Chain Maturity Assessment

Instructions

Score each item as Implemented, Partial, or Not Started. Focus on repos that ship to production first. Use the results to identify your biggest supply chain blind spots and build a remediation plan.

1. Visibility — Do you know what is in your software?

• SBOM generated automatically for every production build
• Direct and transitive dependencies inventoried
• Dependency versions pinned (lockfiles enforced)
• License compliance tracked for all dependencies
• Container base images inventoried and version-tracked
• AI model dependencies (weights, datasets, configs) cataloged

2. Verification — Can you prove where your artifacts came from?

• Build artifacts signed with verifiable signatures
• Container images signed and verified before deployment
• Provenance attestations generated for builds (SLSA or equivalent)
• Source commits signed (GPG or SSH)
• Third-party packages verified against known-good checksums
• Admission controllers enforce signature verification in production

3. Build Integrity — Is your build pipeline tamper-resistant?

• CI/CD pipelines defined as code and version-controlled
• Build environments ephemeral and reproducible
• Pipeline secrets scoped to minimum required access
• Self-hosted runners hardened and monitored
• Build logs retained and auditable
• Pipeline changes require code review and approval

4. Dependency Governance — Do you control what enters your codebase?

• New dependency additions require review and approval
• Automated vulnerability scanning runs on every PR
• Critical vulnerability patches applied within defined SLAs
• Dependency update PRs reviewed, not auto-merged blindly
• Internal package registry or proxy in use (not pulling directly from public)
• Typosquatting and namespace confusion risks monitored

5. AI-Assisted Workflow Controls

• AI-generated code subject to the same review standards as human code
• AI coding agent permissions scoped (file access, tool use, network)
• AI-suggested dependency additions flagged for manual review
• Prompt injection risks assessed for AI-integrated pipelines
• AI tool usage logged and auditable

Maturity Summary

Area	Implemented	Partial	Not Started	Priority Action
Visibility
Verification
Build Integrity
Dependency Governance
AI Workflow Controls

Next Steps

• Top priority gap: _____ | Owner: _____ | Target date: _____
• Second priority gap: _____ | Owner: _____ | Target date: _____
• Third priority gap: _____ | Owner: _____ | Target date: _____