1(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,519401,e=>{e.v(JSON.parse('{"title":"Cloudsmith","url":"https://cloudsmith.com","domain":"cloudsmith.com","signUpUrl":"https://app.cloudsmith.com/signup","bookDemoURL":"https://cloudsmith.com/book-a-demo","socialMedia":{"urls":{"facebook":"https://www.facebook.com/cloudsmith.io/","twitter":"https://twitter.com/cloudsmith","linkedin":"https://www.linkedin.com/company/cloudsmith","youtube":"https://www.youtube.com/channel/UCO8NZYdzB3RgO4HXkHG7QiQ","github":"https://github.com/cloudsmith-io"},"handles":{"twitter":"@cloudsmith"}},"hyvorWebsiteId":"9846","salesEmail":"[email protected]","webinarEmail":"[email protected]","navigatorEmail":"[email protected]","ignoreContentPaths":["navigator/**","product/**"],"seoFallbacks":{"description":"Cloudsmith is a universal, cloud-native solution for software artifact management and software supply chain security. Book a demo today.","image":"https://cloudsmith.com/images/opengraph.png"},"changelogTitle":"Cloudsmith Changelog","changelogDescription":"Latest changes and updates","blogTitle":"Cloudsmith Blog","blogDescription":"Latest articles and insights"}'))},416604,e=>{e.v(JSON.parse('{"seo":{"title":"Cloudsmith Software Supply Chain Security Assessment","description":"Assess your artifact and supply chain security in 20 questions. See where your team is strongest, where risk remains, and what to prioritize next.","ogImage":"/images/artifact-security-maturity-tool/opengraph.png"},"layout":{"hideNav":true,"footerTheme":"dark","pageTheme":"dark"},"hero":{"alignLeft":true,"eyebrow":"20 QUESTIONS ⢠5 MINS","gridBackgroundColor":"grey1000","heading":"Where does your supply chain<br/><strong>security actually stand?</strong>","actions":[{"label":"Start assessment","dialog":"ArtifactSecurityAssessmentDialog","type":"primary","size":"large","withArrow":true,"colorScheme":"accent"}],"markerColor":"green5","markerColorEnd":"","scores":[{"label":"Artifact storage","value":42},{"label":"Public dependencies","value":84},{"label":"Access control","value":46},{"label":"Vulnerability scanning","value":74},{"label":"Supply chain risk","value":86},{"label":"Artifact signing","value":72}],"subline":"Answer 20 questions about your current artifact and supply chain practices. We\'ll place you on a six-level maturity model and show where your team is strongest, where risk remains, and what to prioritize next.","theme":"dark"},"resultsHero":{"eyebrow":"Assessment Results","title":"Your security maturity level","description":"Based on your responses, here\'s how your organization stacks up against industry best practices.","defaultLevelDescription":"Your score reflects current controls across artifact governance, build integrity, and compliance readiness.","industryBenchmarks":["~20% of orgs","~35% of orgs","~25% of orgs","~12% of orgs","~6% of orgs","~2% of orgs"],"cta":{"href":"/book-a-demo-supply-chain-security","labelTemplate":"Chat with us to level up your security"}},"resultsUnavailable":{"invalid":{"title":"Assessment results unavailable","description":"We could not load your assessment from this link. It may be incomplete, expired, or invalid. Start the assessment again to generate fresh results."},"encode":{"title":"Could not generate results","description":"Something went wrong while saving your answers. Please return to the assessment and try submitting again."},"cta":{"label":"Start assessment","href":"/resources/artifact-security-maturity-tool"}},"assessmentSurvey":{"title":"Artifact Security Assessment","resultsHref":"/resources/artifact-security-maturity-tool/results","resultsQueryKey":"a","resultsErrorQueryKey":"error","payloadVersion":"v1","progressLabel":"{{current}}/{{total}}","description":"Complete {{total}} security maturity questions to view your assessment results.","errors":{"encode":"We could not save your answers. Review your selections and try again."},"buttons":{"back":"Back","next":"Next","finish":"View results"},"levelThresholds":[{"level":"L0","label":"Unmanaged","min":0,"max":11},{"level":"L1","label":"Centralized","min":12,"max":24},{"level":"L2","label":"Controlled","min":25,"max":44},{"level":"L3","label":"Secured","min":45,"max":63},{"level":"L4","label":"Verified","min":64,"max":81},{"level":"L5","label":"Optimized","min":82,"max":100}],"dimensions":[{"id":"artifact-storage-governance","label":"Artifact Storage & Repository Governance","questionIds":["q1","q2"]},{"id":"public-dependency-consumption","label":"Public Dependency Consumption","questionIds":["q3","q4"]},{"id":"vulnerability-management","label":"Vulnerability Management","questionIds":["q5","q6"]},{"id":"supply-chain-attack-protection","label":"Supply Chain Attack Protection","questionIds":["q7","q8"]},{"id":"artifact-signing-integrity-verification","label":"Artifact Signing & Integrity Verification","questionIds":["q9","q10"]},{"id":"sbom-provenance","label":"SBOM & Provenance","questionIds":["q11","q12"]}
1,{"id":"license-compliance","label":"License Compliance","questionIds":["q13","q14"]},{"id":"compliance-evidence-audit-readiness","label":"Compliance Evidence & Audit Readiness","questionIds":["q15","q16"]},{"id":"incident-response","label":"Incident Response","questionIds":["q17","q18"]},{"id":"build-pipeline-integrity","label":"Build Pipeline Integrity","questionIds":["q19","q20"]}],"frameworks":[{"id":"slsa","questionWeights":{"q9":3,"q11":3,"q12":3,"q19":3,"q20":3}},{"id":"fedramp","questionWeights":{"q5":3,"q6":3,"q15":3,"q16":3,"q17":3,"q18":3}},{"id":"cra","questionWeights":{"q11":3,"q12":3,"q13":3,"q16":3,"q18":3}},{"id":"dora","questionWeights":{"q1":3,"q4":3,"q6":3,"q17":3,"q18":3}},{"id":"s2c2f","questionWeights":{"q3":3,"q4":3,"q7":3,"q8":3}},{"id":"iso27001","questionWeights":{"q1":1,"q2":1,"q4":1,"q13":1,"q15":1,"q18":1}}],"questions":[{"id":"q1","dimensionId":"artifact-storage-governance","prompt":"Where does your team store internally built packages and artifacts?","options":[{"value":"q1_0","score":0,"label":"Local machines, shared drives, ad-hoc object storage","description":"No centralized control plane for artifacts."},{"value":"q1_2","score":2,"label":"Self-hosted or cloud artifact registry (centralized)","description":"A central registry exists but governance depth is limited."},{"value":"q1_3","score":3,"label":"Managed registry with environment-based repo separation (dev/staging/prod)","description":"Repository separation supports safer release flow."},{"value":"q1_5","score":5,"label":"Fully governed registry with promotion workflows, RBAC, and audit logging","description":"Promotion is controlled and fully traceable."}]},{"id":"q2","dimensionId":"artifact-storage-governance","prompt":"How is access to your artifact repositories controlled at the machine/pipeline level?","options":[{"value":"q2_0","score":0,"label":"Long-lived credentials shared across teams and pipelines","description":"Shared secrets increase blast radius and reduce traceability."},{"value":"q2_1","score":1,"label":"API tokens exist but are not consistently scoped per pipeline","description":"Some control exists but least-privilege is inconsistent."},{"value":"q2_3","score":3,"label":"Each CI pipeline has its own scoped, rotated token with least-privilege access","description":"Pipeline identity is separated and manageable."},{"value":"q2_5","score":5,"label":"Short-lived OIDC tokens (no secrets stored); usage is audited per artifact operation","description":"Ephemeral identity and auditable access are enforced."}]},{"id":"q3","dimensionId":"public-dependency-consumption","prompt":"How does your build system consume packages from public registries?","options":[{"value":"q3_0","score":0,"label":"Directly from the public internet","description":"No centralized policy or dependency control."},{"value":"q3_1","score":1,"label":"Via a basic proxy/cache layer, no security policies","description":"Caching helps performance but not governance."},{"value":"q3_3","score":3,"label":"All public registries proxied through private registry; builds cannot reach internet","description":"Dependency ingress is centralized and constrained."},{"value":"q3_5","score":5,"label":"Proxied plus active allow/deny policies and dependency firewalling","description":"Policy enforcement prevents unapproved dependencies."}]},{"id":"q4","dimensionId":"public-dependency-consumption","prompt":"How do you vet new open-source dependencies before they are adopted?","options":[{"value":"q4_0","score":0,"label":"No process; developers add whatever they need","description":"Dependency adoption is ungoverned."},{"value":"q4_1","score":1,"label":"Informal review by the developer who introduces it","description":"Review occurs but is not standardized."},{"value":"q4_3","score":3,"label":"Formal review process with OpenSSF Scorecard or equivalent checks","description":"Health checks are part of dependency intake."},{"value":"q4_5","score":5,"label":"Automated pre-approval gate for license, CVE, and Scorecard policy checks","description":"Unapproved dependencies are blocked before build use."}]},{"id":"q5","dimensionId":"vulnerability-management","prompt":"How are vulnerabilities in your dependencies and artifacts identified?","options":[{"value":"q5_0","score":0,"label":"They are not identified; no scanning","description":"Known and newly disclosed vulnerabilities can be missed."},{"value":"q5_1","score":1,"label":"Ad-hoc or manual scanning","description":"Coverage is irregular and incomplete."},{"value":"q5_3","score":3,"label":"Automated scanning in CI, informational only","description":"Findings are detected but not enforced."},{"value":"q5_5","score":5,"label":"Automated scanning with policy-driven quarantine and CI gate enforcement","description":"Risky artifacts are actively blocked."}]},{"id":"q6","dimensionId":"vulnerability-management","prompt":"When a critical CVE is found in a package, what is your remediation SLA?","options":[{"value":"q6_0","score":0,"label":"No defined SLA; fixed whenever time allows","description":"Critical fixes are not time-bound."},{"value":"q6_1","score":1,"label":"Informal urgency, no tracking","description":"Intent exists but execution is inconsistent."},{"value":"q6_3","score":3,"label":"Documented SLA by severity (for example, Critical = 72h), tracked manually","de
1scription":"Response timing is defined and observable."},{"value":"q6_5","score":5,"label":"Automated tracking with quarantine, PR/ticket creation, SLA countdown, and escalation","description":"Remediation workflow is enforced automatically."}]},{"id":"q7","dimensionId":"supply-chain-attack-protection","prompt":"How do you protect against dependency confusion and typosquatting?","options":[{"value":"q7_0","score":0,"label":"No protections in place","description":"Confusion and typo attacks are largely unchecked."},{"value":"q7_1","score":1,"label":"Aware of risk but no implemented mitigations","description":"Risk is known but controls are missing."},{"value":"q7_3","score":3,"label":"All external packages proxied with namespace controls","description":"Core confusion vectors are reduced."},{"value":"q7_5","score":5,"label":"Full dependency firewall with allow/deny lists, Scorecard monitoring, and threat intel feeds","description":"Ingress is policy-aware and threat-informed."}]},{"id":"q8","dimensionId":"supply-chain-attack-protection","prompt":"Do you have visibility into the health and reputation of your open-source dependencies?","options":[{"value":"q8_0","score":0,"label":"No visibility into dependency maintenance status","description":"Dependency health regressions go unnoticed."},{"value":"q8_1","score":1,"label":"Manual checks on popular packages occasionally","description":"Coverage is limited to ad-hoc review."},{"value":"q8_3","score":3,"label":"Periodic OpenSSF Scorecard (or equivalent) checks on key dependencies","description":"Health is assessed on a recurring basis."},{"value":"q8_5","score":5,"label":"Continuous automated OSS health monitoring with score-drop alerts","description":"Degraded dependency health triggers action quickly."}]},{"id":"q9","dimensionId":"artifact-signing-integrity-verification","prompt":"Are your internally published artifacts cryptographically signed?","options":[{"value":"q9_0","score":0,"label":"No; artifacts are unsigned","description":"Artifact authenticity is not provable."},{"value":"q9_1","score":1,"label":"Some artifacts are signed informally; no consistent policy","description":"Signing exists but is not enforceable."},{"value":"q9_3","score":3,"label":"Signing enforced for production artifacts (GPG/PGP or Cosign)","description":"Production integrity controls are standardized."},{"value":"q9_5","score":5,"label":"All artifacts signed and verified at deployment via admission controller","description":"Unsigned artifacts are rejected before runtime."}]},{"id":"q10","dimensionId":"artifact-signing-integrity-verification","prompt":"How do you verify artifact integrity at consumption time before deployment?","options":[{"value":"q10_0","score":0,"label":"No verification; registry is implicitly trusted","description":"Tampered artifacts may pass through."},{"value":"q10_1","score":1,"label":"Manual checksum verification on an ad-hoc basis","description":"Verification is inconsistent and easy to bypass."},{"value":"q10_3","score":3,"label":"Automated checksum/digest verification in CI before deployment","description":"Integrity checks are repeatable for deployment flows."},{"value":"q10_5","score":5,"label":"Cryptographic signature verification required; unsigned artifacts rejected automatically","description":"Integrity verification is mandatory and enforced."}]},{"id":"q11","dimensionId":"sbom-provenance","prompt":"Do you generate SBOMs or provenance attestations?","options":[{"value":"q11_0","score":0,"label":"No SBOMs or provenance are generated","description":"Component lineage is largely opaque."},{"value":"q11_1","score":1,"label":"Explored but not consistently implemented","description":"Capability is partial and non-standard."},{"value":"q11_3","score":3,"label":"SBOMs generated in CI and stored with artifacts (CycloneDX or SPDX)","description":"Artifact metadata exists for audits and response."},{"value":"q11_5","score":5,"label":"SBOMs and SLSA provenance attached to every artifact automatically","description":"End-to-end chain from source to production is established."}]},{"id":"q12","dimensionId":"sbom-provenance","prompt":"Are your SBOMs kept up to date as software changes over time?","o
1ptions":[{"value":"q12_0","score":0,"label":"No SBOMs are generated","description":"No SBOM update process exists."},{"value":"q12_1","score":1,"label":"SBOMs generated occasionally, not on every release","description":"SBOM recency is unreliable."},{"value":"q12_3","score":3,"label":"SBOM generated on every artifact publish and tied to version","description":"Release-linked documentation is consistent."},{"value":"q12_5","score":5,"label":"SBOMs immutably linked to artifact digests and regenerated for every version automatically","description":"Version-specific SBOM integrity is fully automated."}]},{"id":"q13","dimensionId":"license-compliance","prompt":"How does your organization track open-source license obligations?","options":[{"value":"q13_0","score":0,"label":"No tracking; license types are unknown","description":"Legal exposure is unmanaged."},{"value":"q13_1","score":1,"label":"Developers check manually with inconsistent execution","description":"Tracking exists but is unreliable."},{"value":"q13_3","score":3,"label":"Automated license scanning with copyleft flagging","description":"High-risk licenses are identified routinely."},{"value":"q13_5","score":5,"label":"License compliance enforced as promotion gate with auditable inventory","description":"Non-compliant packages are blocked before promotion."}]},{"id":"q14","dimensionId":"license-compliance","prompt":"Are open-source license obligations reviewed as part of new software releases or distribution decisions?","options":[{"value":"q14_0","score":0,"label":"No process; licenses are not reviewed before distribution","description":"Release decisions do not account for license terms."},{"value":"q14_1","score":1,"label":"Ad-hoc reviews when issues are raised","description":"Review is reactive and inconsistent."},{"value":"q14_3","score":3,"label":"License review required before external release","description":"Distribution checks are part of release governance."},{"value":"q14_5","score":5,"label":"Automated license clearance in release pipeline with regional/customer controls","description":"Distribution can be blocked automatically by license policy."}]},{"id":"q15","dimensionId":"compliance-evidence-audit-readiness","prompt":"How do you manage compliance evidence and audit trails?","options":[{"value":"q15_0","score":0,"label":"No audit trail exists","description":"Evidence production is not feasible."},{"value":"q15_1","score":1,"label":"Basic logging exists but is not centralized or exportable","description":"Audit readiness is fragile and slow."},{"value":"q15_3","score":3,"label":"Audit logs are centralized and periodically exported to compliance platform","description":"Evidence gathering is repeatable with manual effort."},{"value":"q15_5","score":5,"label":"Continuous automated compliance monitoring with real-time dashboards and auditor access","description":"Evidence is always current and immediately accessible."}]},{"id":"q16","dimensionId":"compliance-evidence-audit-readiness","prompt":"How quickly can you produce a complete software component inventory for a specific production artifact?","options":[{"value":"q16_0","score":0,"label":"Cannot produce inventory; no inventory exists","description":"Component traceability is absent."},{"value":"q16_1","score":1,"label":"Hours to days of manual investigation","description":"Inventory can be assembled but slowly."},{"value":"q16_3","score":3,"label":"Hours; query registry and SBOM store","description":"Inventory is available with some manual steps."},{"value":"q16_5","score":5,"label":"Minutes; automated query returns component tree, CVE status, and provenance chain","description":"Production traceability is near real time."}]},{"id":"q17","dimensionId":"incident-response","prompt":"If a critical CVE were discovered in a package used across your builds today, how would you respond?","options":[{"value":"q17_0","score":0,"label":"Response would be difficult; no dependency inventory","description":"Impact discovery and triage would be delayed."},{"value":"q17_1","score":1,"label":"Manual identification via chat/email; time-consuming and incomplete","description":"Response depends on institutional memory."},{"value":"q17_3","score":3,"label":"Registry scan results used to find and quarantine affected packages, with some manual steps","description":"Containment is possible but not fully automated."}
1,{"value":"q17_5","score":5,"label":"Automated workflow triggers quarantine plus remediation PRs and SLA tracking","description":"Detection-to-remediation cycle is orchestrated end-to-end."}]},{"id":"q18","dimensionId":"incident-response","prompt":"Do you have a documented process for disclosing supply chain security incidents to customers or regulators?","options":[{"value":"q18_0","score":0,"label":"No process; would determine approach during incident","description":"Disclosure timing and ownership are unclear."},{"value":"q18_1","score":1,"label":"General incident plan exists but supply chain specifics are missing","description":"Process partially covers required disclosures."},{"value":"q18_3","score":3,"label":"Documented supply chain incident playbook with legal and communications roles","description":"Disclosure responsibilities and flow are defined."},{"value":"q18_5","score":5,"label":"Automated detection triggers disclosure workflow with timeline tracking for required windows","description":"Reporting timelines are monitored and enforced."}]},{"id":"q19","dimensionId":"build-pipeline-integrity","prompt":"Where do your production artifact builds run?","options":[{"value":"q19_0","score":0,"label":"Developer laptops or long-running shared build servers","description":"Build provenance and isolation are weak."},{"value":"q19_1","score":1,"label":"Primarily CI, but some critical builds still run locally","description":"Build trust boundary is mixed."},{"value":"q19_3","score":3,"label":"All production builds run in hosted CI/CD service","description":"Build platform is centralized and controlled."},{"value":"q19_5","score":5,"label":"All builds run on hardened ephemeral isolated environments","description":"Builds cannot influence each other or forge provenance."}]},{"id":"q20","dimensionId":"build-pipeline-integrity","prompt":"Do your builds have access to external resources beyond what they strictly need?","options":[{"value":"q20_0","score":0,"label":"Yes; broad network access and many shared secrets","description":"Build-time attack surface is large."},{"value":"q20_1","score":1,"label":"Mostly CI-based; internet access is not restricted during builds","description":"Build controls exist but egress remains open."},{"value":"q20_3","score":3,"label":"Scoped secrets used; production secrets separate from development","description":"Secret hygiene and boundary control are established."},{"value":"q20_5","score":5,"label":"Network egress restricted to internal registry, short-lived build-scoped secrets, hermetic builds in progress","description":"Build environment follows least-privilege and isolation principles."}]}]},"maturitySection":{"section":{"theme":"dark","paddingTop":"2xl","paddingBottom":"2xl","sectionWidth":"small","gradientShape":"linear","sticky":false,"withBorder":false,"headingTag":"h2","layout":"vertical","actionsOnRight":true,"removeMargin":false,"titleTextSize":"large"},"title":"Maturity models","tabsHeroTitle":"","tabs":[{"title":"0","themeColor":"var(--brand-color-red-5)","label":"Unmanaged","hero":{"theme":{"backgroundColor":"var(--brand-color-red-3)","sublineColor":"var(--brand-color-red-7)","textColor":"var(--brand-color-red-9)"},"subline":"High exposure","description":"Artifacts are produced and distributed without governance, traceability, or security controls."},"panels":[{"id":"artifact-management","title":"Artifact Management","icon":"artifact-management","layout":"vertical","text":["How you store, version, promote, and distribute binaries, packages, images, and ML models."],"items":[{"id":"artifact-storage-governance","eyebrow":"Artifact Storage & Repository Governance","title":"No central governance","text":"Artifacts are often pulled from public repositories and stored on local machines, shared drives, or ad-hoc object storage with no central governance. There is no single source of truth for what has been built or deployed."},{"id":"artifact-signing-integrity-verification","eyebrow":"Artifact Signing & Integrity Verification","title":"No signing or verification","text":"Artifacts are unsigned and there is no verification step before deployment. There is no way to detect whether an artifact has been tampered with after it was built."},{"id":"sbom-provenance","eyebrow":"SBOM & Provenance","title":"No SBOMs or provenance","text":"No SBOMs or provenance documents are generated. You have no machine-readable record of what components are in y
1our software or where they came from."},{"id":"build-pipeline-integrity","eyebrow":"Build Pipeline Integrity","title":"Local builds, no isolation","text":"Production builds run on developer laptops or long-running shared build servers. There is no isolation between builds, and the provenance of artifacts cannot be verified."}]},{"id":"supply-chain-security","title":"Supply Chain Security","icon":"supply-chain-security","layout":"vertical","text":["Controls across your dependency graph: proxying, scanning, signing, policy management and protection against supply chain attacks."],"items":[{"id":"public-dependency-consumption","eyebrow":"Public Dependency Consumption","title":"Direct public internet pulls","text":"Builds pull dependencies directly from the public internet with no proxy, no caching, and no security policy. You have no visibility into or control over what enters your build from upstream registries."},{"id":"vulnerability-management","eyebrow":"Vulnerability Management","title":"No vulnerability scanning","text":"No vulnerability scanning is in place. You have no systematic way to know whether the packages in your builds or registries contain known CVEs."},{"id":"supply-chain-attack-protection","eyebrow":"Supply Chain Attack Protection","title":"No attack protection","text":"No protections are in place against dependency confusion, typosquatting, or package substitution attacks. Your build graph is exposed to name-based supply chain attacks."}]},{"id":"regulatory-alignment","title":"Regulatory Alignment","icon":"regulatory-framework-alignment","layout":"vertical","text":["Your auditability and compliance posture as it relates to visibility and governance of your supply chain."],"items":[{"id":"license-compliance","eyebrow":"License Compliance","title":"No license tracking","text":"License obligations across your dependencies are unknown. There is no process to identify or track open-source license types, creating significant legal and distribution risk."},{"id":"compliance-evidence-audit-readiness","eyebrow":"Compliance Evidence & Audit Readiness","title":"No audit trail","text":"No audit trail exists for artifact operations. In the event of an audit or incident, you would have no systematic records of what was built, accessed, or deployed."},{"id":"incident-response","eyebrow":"Incident Response","title":"No supply chain IR","text":"If a critical CVE were found in production today, your team would have no systematic way to identify which artifacts or services are affected. Response would be entirely manual and time-consuming."}]},{"id":"framework-readiness","title":"Framework Readiness","icon":"framework-readiness","layout":"vertical","text":["How your current practices map to the specific controls, attestations, and documentation requirements of each major compliance framework."],"items":[{"id":"slsa","eyebrow":"SLSA","title":"No provenance","text":"Your build process does not yet produce provenance documentation. Artifacts cannot be traced cryptographically from source to registry, leaving your supply chain integrity unverifiable."},{"id":"fedramp","eyebrow":"FedRAMP","title":"Insufficient controls","text":"Your current controls are insufficient to support a FedRAMP assessment. Foundational requirements such as vulnerability scanning, access control, and audit logging are not yet in place."},{"id":"cra","eyebrow":"CRA","title":"Significantly underprepared","text":"Your current practices leave you significantly underprepared for CRA compliance. SBOM generation, component documentation, and vulnerability disclosure processes, all mandatory under the CRA, are not yet established."},{"id":"dora","eyebrow":"DORA","title":"Significant ICT risk exposure","text":"Your current practices create significant ICT risk exposure under DORA. Dependency documentation, vulnerability management SLAs, and third-party oversight processes, all required under DORA, are not in place."},{"id":"s2c2f","eyebrow":"S2C2F","title":"Ungoverned OSS consumption","text":"Your open-source dependency consumption is ungoverned. You lack the inventory, scanning, and governance practices that form the baseline of the Secure Supply Chain Consumption Framework."},{"id":"iso27001","eyebrow":"ISO 27001","title":"Insufficient documentation","text":"Your current artifact and supply chain practices lack the documentation and controls needed to support ISO 27001 certification. No systematic evidence of supplier security, vulnerability management, or access governance exists."}]}],"footer":{"theme":{"backgroundColor":"var(--brand-color-red-5)"},"text":"Chat with us to get a full assessment","cta":{"label":"Book a demo","href":"/book-a-demo-supply-chain-security","type":"primary","size":"medium","withArrow":true,"colorScheme":"accent"}}},{"title":"1","themeColor":"var(--brand-color-salmon-4)","label":"Centralized","hero":{"theme":{"backgroundColor":"var(--brand-color-salmon-3)","sublineColor":"var(--brand-color-salmon-7)","textColor":"var(--brand-color-salmon-9)"},"subline":"Elevated exposure","description":"You have a registry, but governance, signing, and supply chain controls are still largely manual or absent."},"panels":[{"id":"artifact-management","title":"Artifact Management","icon":"artifact-management","layout":"vertical","text":["How you store, version, promote, and distribute binaries, packages, images, and ML models."],"items":[{"id":"artifact-storage-governance","eyebrow":"Artifact Storage & Repository Governance","title":"Basic central registry","text":"You have a centralized artifact registry, giving your team a single place to store and retrieve packages. Access controls and environment separation are limited or informal."},{"id":"artifact-signing-integrity-verification","eyebrow":"Artifact Signing & Integrity Verification","title":"Informal, incomplete signing","text":"Some artifacts are signed informally, but there is no consistent policy and signing coverage is incomplete. Verification is ad-hoc and not systematically enforced."},{"id":"sbom-provenance","eyebrow":"SBOM & Provenance","title":"Inconsistent SBOM generation","text":"You have explored SBOM generation but it is inconsistent: not produced on every release and not stored alongside artifacts in a systematic way."},{"id":"build-pipeline-integrity","eyebrow":"Build Pipeline Integrity","title":"Mostly CI, not fully isolated","text":"Most builds run in CI, but some critical builds still happen locally. Build environments are not consistently hardened or isolated from each other."}]},{"id":"supply-chain-security","title":"Supply Chain Security","icon":"supply-chain-security","layout":"vertical","text":["Controls across your dependency graph: proxying, scanning, signing, policy management and protection against supply chain attacks."],"items":[{"id":"public-dependency-consumption","eyebrow":"Public Dependency Consumption","title":"Basic proxy, no policies","text":"You have a basic proxy or cache layer for some registries, but security policies are not enforced and builds can still reach the public internet directly."},{"id":"vulnerability-management","eyebrow":"Vulnerability Management","title":"Manual or ad-hoc scanning","text":"Vulnerability scanning exists but is manual or ad-hoc. Results are informational and do not block builds or trigger remediation workflows."},{"id":"supply-chain-attack-protection","eyebrow":"Supply Chain Attack Protection","title":"Risks identified, not mitigated","text":"You are aware of dependency confusion and typosquatting risks, but mitigations have not been formally implemented. Your builds may be exposed to upstream namespace attacks."}]},{"id":"regulatory-alignment","title":"Regulatory Alignment","icon":"regulatory-framework-alignment","layout":"vertical","text":["Your auditability and compliance posture as it relates to visibility and governance of your supply chain."],"items":[{"id":"license-compliance","eyebrow":"License C
1ompliance","title":"Inconsistent manual checks","text":"Developers are expected to check licenses manually, but this is inconsistent. Copyleft and restrictive licenses may be present in your build graph without formal review."},{"id":"compliance-evidence-audit-readiness","eyebrow":"Compliance Evidence & Audit Readiness","title":"Basic, decentralized logging","text":"Basic logging exists but is not centralized or easily exported. Producing compliance evidence requires significant manual effort and may be incomplete."},{"id":"incident-response","eyebrow":"Incident Response","title":"General IR, no supply chain specifics","text":"You have a general incident response process, but supply chain specifics such as identifying all artifacts consuming a vulnerable package are not addressed and would require significant manual investigation."}]},{"id":"framework-readiness","title":"Framework Readiness","icon":"framework-readiness","layout":"vertical","text":["How your current practices map to the specific controls, attestations, and documentation requirements of each major compliance framework."],"items":[{"id":"slsa","eyebrow":"SLSA","title":"Conceptual SLSA L1 prerequisites","text":"You are generating basic provenance records, but builds may still run on local machines and provenance is not cryptographically signed. You meet the conceptual prerequisites for SLSA L1 but not the technical requirements."},{"id":"fedramp","eyebrow":"FedRAMP","title":"Significant gaps remain","text":"You have some of the foundational controls FedRAMP requires, but significant gaps remain in supply chain risk management, vulnerability remediation SLAs, and software integrity verification."},{"id":"cra","eyebrow":"CRA","title":"Significant work needed","text":"You have begun building the practices the CRA requires, but SBOM generation is inconsistent and vulnerability disclosure processes are not formalized. Full compliance by December 2027 will require significant work."},{"id":"dora","eyebrow":"DORA","title":"Partially addressed","text":"Some governance foundations exist, but DORA\'s requirements around ICT risk management, third-party oversight, and patch management SLAs are only partially addressed. Financial sector customers may flag these gaps."},{"id":"s2c2f","eyebrow":"S2C2F","title":"Basic OSS inventory, partial L1","text":"You have basic OSS inventory and ad-hoc vulnerability awareness, but automation and policy enforcement are limited. You partially meet S2C2F Level 1 but have not yet reached the improved MTTR practices of Level 2."},{"id":"iso27001","eyebrow":"ISO 27001","title":"Informal controls, limited scope","text":"Basic controls are in place but are informal and inconsistently documented. With focused effort on documenting what you have, ISO 27001 certification may be achievable for a limited scope."}]}],"footer":{"theme":{"backgroundColor":"var(--brand-color-salmon-4)"}}},{"title":"2","themeColor":"var(--brand-color-yellow-3)","label":"Controlled","hero":{"theme":{"backgroundColor":"var(--brand-color-yellow-3)","sublineColor":"var(--brand-color-yellow-7)","textColor":"var(--brand-color-yellow-9)"},"subline":"Moderate exposure","description":"Your build and distribution pipeline is in CI, dependencies are proxied, and basic security scanning is underway."},"panels":[{"id":"artifact-management","title":"Artifact Management","icon":"artifact-management","layout":"vertical","text":["How you store, version, promote, and distribute binaries, packages, images, and ML models."],"items":[{"id":"artifact-storage-governance","eyebrow":"Artifact Storage & Repository Governance","title":"Environment-separated, managed promotion","text":"Your registry is structured with environment-based repository separation (dev/staging/prod) and basic RBAC. Promotion between environments is managed, though not yet fully automated."},{"id":"artifact-signing-integrity-verification","eyebrow":"Artifact Signing & Integrity Verification","title":"Policy-enforced release signing","text":"Production artifacts are signed using GPG, PGP, or Cosign. Signing is enforced by policy for releases, though verification at deployment time is not yet automated."},{"id":"sbom-provenance","eyebrow":"SBOM & Provenance","title":"SBOMs in CI, incomplete provenance","text":"SBOMs in CycloneDX or SPDX format are generated in CI and stored alongside artifacts. You can answer \\"what\'s in this build?\\" though provenance links to specific source commits are incomplete."},{"id":"build-pipeline-integrity","eyebrow":"Build Pipeline Integrity","title":"Hosted CI, not yet ephemeral","text":"All production builds run in a hosted CI/CD service. Build environments are consistent, though not yet ephemeral or isolated at the level required for SLSA L3."}]},{"id":"supply-chain-security","title":"Supply Chain Security","icon":"supply-chain-security","layout":"vertical","text":["Controls across your dependency graph: proxying, scanning, signing, policy management and protection against supply chain attacks."],"items":[{"id":"public-dependency-consumption","eyebrow":"Public Dependency Consumption","title":"All registries proxied","text":"All public registries are routed through your private registry. Builds cannot reach the internet directly, and you have visibility into what external packages are being consumed."},{"id":"vulnerability-management","eyebrow":"Vulnerability Management","title":"Automated scanning in CI","text":"Automated vulnerability scanning runs in CI. Scan results are surfaced to developers, though blocking policies and remediation SLAs are not yet enforced."},{"id":"supply-chain-attack-protection","eyebrow":"Supply Chain Attack Protection","title":"Namespace controls active","text":"All external packages are proxied through your private registry and namespace controls are active. The attack surface for dependency confusion is substantially reduced."}]},{"id":"regulatory-alignment","title":"Regulatory Alignment","icon":"regulatory-framework-alignment","layout":"vertical","text":["Your auditability and compliance posture as it relates to visibility and governance of your supply chain."],"items":[{"id":"license-compliance","eyebrow":"License C
1ompliance","title":"Automated scanning, flagging in place","text":"License scanning is automated and copyleft licenses are flagged. You have visibility into your license inventory, though enforcement gates are not yet in place."},{"id":"compliance-evidence-audit-readiness","eyebrow":"Compliance Evidence & Audit Readiness","title":"Centralized logs, periodic export","text":"Audit logs are centralized and periodically exported to a compliance platform. You can produce artifact evidence, though assembly takes hours rather than minutes."},{"id":"incident-response","eyebrow":"Incident Response","title":"Registry-assisted triage, some manual steps","text":"You can use registry scan results to identify and quarantine affected packages, though some manual steps remain. Your supply chain incident process is documented but not fully automated."}]},{"id":"framework-readiness","title":"Framework Readiness","icon":"framework-readiness","layout":"vertical","text":["How your current practices map to the specific controls, attestations, and documentation requirements of each major compliance framework."],"items":[{"id":"slsa","eyebrow":"SLSA","title":"SLSA L1âL2 capable","text":"Your CI-based builds are positioned to achieve SLSA L1 to L2. Provenance generation is in progress, and your build platform is capable of signed provenance with the right integrations."},{"id":"fedramp","eyebrow":"FedRAMP","title":"Partial alignment","text":"Your artifact controls partially address FedRAMP requirements. Vulnerability scanning and access controls are in place, though SBOM practices and formal supply chain risk management documentation need further development."},{"id":"cra","eyebrow":"CRA","title":"Building toward compliance","text":"SBOM generation is underway and vulnerability management is in place. You are building toward CRA compliance, but version-specific SBOM tracking and disclosure workflows need development to meet the December 2027 deadline."},{"id":"dora","eyebrow":"DORA","title":"Partial ICT risk management","text":"Your artifact governance partially satisfies DORA\'s ICT risk management requirements. Dependency tracking and vulnerability management are underway, though formal third-party risk documentation and incident response processes need strengthening."},{"id":"s2c2f","eyebrow":"S2C2F","title":"S2C2F Level 2 alignment","text":"Automated dependency scanning and curated internal feeds are in place. Your practices align with S2C2F Level 2, and you are building toward the proactive prevention controls of Level 3."},{"id":"iso27001","eyebrow":"ISO 27001","title":"Certification scope supportable","text":"Your controls are sufficiently mature to support an ISO 27001 certification scope that includes artifact management. Supplier security, access governance, and vulnerability management practices are documented and operational."}]}],"footer":{"theme":{"backgroundColor":"var(--brand-color-yellow-4)"}}},{"title":"3","themeColor":"var(--brand-color-green-3)","label":"Secured","hero":{"theme":{"backgroundColor":"var(--brand-color-green-3)","sublineColor":"var(--brand-color-green-7)","textColor":"var(--brand-color-green-9)"},"subline":"Controlled exposure","description":"Signing, SBOMs, and enforcement gates are in place. Your artifact supply chain is meaningfully protected."},"panels":[{"id":"artifact-management","title":"Artifact Management","icon":"artifact-management","layout":"vertical","text":["How you store, version, promote, and distribute binaries, packages, images, and ML models."],"items":[{"id":"artifact-storage-governance","eyebrow":"Artifact Storage & Repository Governance","title":"Governed registry with audit logging","text":"You have a well-governed registry with promotion workflows, role-based access controls, and audit logging. Your artifact lifecycle is traceable from build to deployment."},{"id":"artifact-signing-integrity-verification","eyebrow":"Artifact Signing & Integrity Verification","title":"All artifacts signed and auto-verified","text":"All artifacts are signed, and signatures are automatically verified before deployment. Unsigned artifacts trigger warnings, and your signing process is fully integrated into your CI pipeline."},{"id":"sbom-provenance","eyebrow":"SBOM & Provenance","title":"SBOMs and
1SLSA provenance per artifact","text":"SBOMs and SLSA provenance are attached to every artifact automatically. Each artifact version has a corresponding SBOM tied to its digest, establishing a verifiable chain from source to storage."},{"id":"build-pipeline-integrity","eyebrow":"Build Pipeline Integrity","title":"Ephemeral CI with scoped secrets","text":"Builds run in hosted, ephemeral CI environments with scoped secrets and restricted network access. Build isolation is enforced and builds cannot influence each other\'s outputs."}]},{"id":"supply-chain-security","title":"Supply Chain Security","icon":"supply-chain-security","layout":"vertical","text":["Controls across your dependency graph: proxying, scanning, signing, policy management and protection against supply chain attacks."],"items":[{"id":"public-dependency-consumption","eyebrow":"Public Dependency Consumption","title":"Active allow/deny dependency policies","text":"External dependencies are proxied with active allow/deny policies in place. Your dependency firewall prevents unapproved packages from entering your builds."},{"id":"vulnerability-management","eyebrow":"Vulnerability Management","title":"Policy-gated scanning with CVE quarantine","text":"Vulnerability scanning is enforced with policy-driven CI gates. Critical CVEs quarantine affected packages and trigger remediation workflows with defined SLAs per severity level."},{"id":"supply-chain-attack-protection","eyebrow":"Supply Chain Attack Protection","title":"Firewall with OSS health scoring","text":"Your dependency firewall enforces allow/deny lists and namespace protections. You have visibility into the health and reputation of your open-source dependencies through automated scoring."}]},{"id":"regulatory-alignment","title":"Regulatory Alignment","icon":"regulatory-framework-alignment","layout":"vertical","text":["Your auditability and compliance posture as it relates to visibility and governance of your supply chain."],"items":[{"id":"license-compliance","eyebrow":"License Compliance","title":"License enforcement as promotion gate","text":"License compliance is enforced as a promotion gate. Non-compliant packages are blocked from advancing through your pipeline, and your license inventory is auditable."},{"id":"compliance-evidence-audit-readiness","eyebrow":"Compliance Evidence & Audit Readiness","title":"Continuously collected, accessible evidence","text":"Compliance evidence is continuously collected and centrally accessible. Auditors can access structured logs and artifact metadata, and you can produce a component inventory in under an hour."},{"id":"incident-response","eyebrow":"Incident Response","title":"Automated quarantine and SLA-tracked remediation","text":"CVE discovery triggers automated quarantine, dependency update PRs, and SLA-tracked remediation workflows. Your team can respond to supply chain incidents consistently and within defined time windows."}]},{"id":"framework-readiness","title":"Framework Readiness","icon":"framework-readiness","layout":"vertical","text":["How your current practices map to the specific controls, attestations, and documentation requirements of each major compliance framework."],"items":[{"id":"slsa","eyebrow":"SLSA","title":"SLSA L2, working toward L3","text":"You are generating signed provenance in CI and consuming Cosign or Sigstore for artifact signing. You meet SLSA L2 requirements and are working toward the hardened, isolated builds required for L3."},{"id":"fedramp","eyebrow":"FedRAMP","title":"FedRAMP Moderate alignment","text":"Your controls are substantially aligned with FedRAMP Moderate requirements. SBOM generation, scanning, and access governance are in place, giving you a credible path to supporting a FedRAMP authorization assessment."},{"id":"cra","eyebrow":"CRA","title":"Substantially CRA-ready","text":"Your SBOM practices, vulnerability management, and component documentation are substantially CRA-ready. With focused work on lifecycle SBOM freshness and disclosure automation, you are on track for December 2027 compliance."},{"id":"dora","eyebrow":"DORA","title":"Aligned with DORA Articles 6 and 9","text":"Your ICT risk controls are substantially aligned with DORA Articles 6 and 9. Dependency inventory, vulnerability SLAs, and audit trails are in place, letting you demonstrate meaningful supply chain governance to financial sector customers."},{"id":"s2c2f","eyebrow":"S2C2F","title":"S2C2F Level 3 alignment","text":"Allowlists, namespace protection, and OSS health scoring are in place. Your practices align with S2C2F Level 3 and you are proactively governing what open-source software can enter your build graph."},{"id":"iso27001","eyebrow":"ISO 27001","title":"Certification asse
1ssment supportable","text":"Your artifact security controls are well-aligned with ISO 27001 Annex A requirements for supplier relationships (A.5.19 to 5.22) and vulnerability management (A.8.8). A formal certification assessment is supportable."}]}],"footer":{"theme":{"backgroundColor":"var(--brand-color-green-3)"}}},{"title":"4","themeColor":"var(--brand-color-purple-5)","label":"Verified","hero":{"theme":{"backgroundColor":"var(--brand-color-purple-3)","sublineColor":"var(--brand-color-purple-7)","textColor":"var(--brand-color-purple-9)"},"subline":"Low exposure","description":"Signed provenance, automated compliance, and policy enforcement give you cryptographic assurance from source to production."},"panels":[{"id":"artifact-management","title":"Artifact Management","icon":"artifact-management","layout":"vertical","text":["How you store, version, promote, and distribute binaries, packages, images, and ML models."],"items":[{"id":"artifact-storage-governance","eyebrow":"Artifact Storage & Repository Governance","title":"Fully automated, policy-driven governance","text":"Artifact governance is fully automated and enforced. All artifact operations are logged, access is scoped with least-privilege credentials, and your promotion workflows are policy-driven and auditable end-to-end."},{"id":"artifact-signing-integrity-verification","eyebrow":"Artifact Signing & Integrity Verification","title":"Automated signing, tampered artifacts rejected","text":"Cryptographic signing and signature verification are fully automated and enforced. Unsigned or tampered artifacts are automatically rejected before deployment, and your signing keys are managed and auditable."},{"id":"sbom-provenance","eyebrow":"SBOM & Provenance","title":"Signed provenance and version-specific SBOMs","text":"Every artifact has signed provenance and a version-specific SBOM immutably linked to its digest. Your attestation pipeline is fully automated, cryptographically verifiable, and ready for regulatory review."},{"id":"build-pipeline-integrity","eyebrow":"Build Pipeline Integrity","title":"Hermetic builds, SLSA L3","text":"Your builds are hermetic and isolated: no persistent state, network egress is restricted to your internal registry, and secrets are short-lived and build-scoped. Your pipeline meets SLSA L3 requirements."}]},{"id":"supply-chain-security","title":"Supply Chain Security","icon":"supply-chain-security","layout":"vertical","text":["Controls across your dependency graph: proxying, scanning, signing, policy management and protection against supply chain attacks."],"items":[{"id":"public-dependency-consumption","eyebrow":"Public Dependency Consumption","title":"Fully governed, continuously monitored","text":"External dependency consumption is fully governed: proxied, policy-enforced, and continuously monitored. New packages require automated health and policy checks before they can enter your build graph."},{"id":"vulnerability-management","eyebrow":"Vulnerability Management","title":"Automated CVE-to-remediation chain","text":"Vulnerability management is fully automated. CVE discovery triggers package quarantine, automated PRs, and tracked remediation with SLA enforcement and escalation policies, closing the gap between detection and remediation to days, not months."},{"id":"supply-chain-attack-protection","eyebrow":"Supply Chain Attack Protection","title":"Comprehensive, continuously monitored protection","text":"Supply chain attack protection is comprehensive and continuously monitored. OSS health scores are tracked automatically, alerts fire when dependency health drops, and threat intelligence feeds keep your allowlists current."}]},{"id":"regulatory-alignment","title":"Regulatory Alignment","icon":"regulatory-framework-alignment","layout":"vertical","text":["Your auditability and compliance posture as it relates to visibility and governance of your supply chain."],"items":[{"id":"license-compliance","eyebrow":"License Compliance","title":"Fully automated, jurisdiction-aware enforcement","text":"License compliance is fully automated and enforced at every stage of your pipeline. Distribution rules can block specific packages by license type and jurisdiction, and
1your entire license inventory is continuously maintained and auditable."},{"id":"compliance-evidence-audit-readiness","eyebrow":"Compliance Evidence & Audit Readiness","title":"Real-time compliance monitoring","text":"Compliance monitoring is automated and real-time. Artifact metadata, SBOM data, and access logs are queryable in minutes, giving auditors and security teams instant access to the evidence they need."},{"id":"incident-response","eyebrow":"Incident Response","title":"Fully automated, regulatory-ready IR","text":"Supply chain incident response is fully automated and regulatory-ready. CVE detection triggers a complete response chain, from quarantine to customer notification, with DORA and CRA reporting timelines tracked automatically."}]},{"id":"framework-readiness","title":"Framework Readiness","icon":"framework-readiness","layout":"vertical","text":["How your current practices map to the specific controls, attestations, and documentation requirements of each major compliance framework."],"items":[{"id":"slsa","eyebrow":"SLSA","title":"SLSA L3 achieved","text":"Your build pipeline meets SLSA L3. Builds run in ephemeral, isolated environments; provenance is signed and logged to a transparency ledger; and the entire chain from source commit to deployed artifact is cryptographically verifiable."},{"id":"fedramp","eyebrow":"FedRAMP","title":"FedRAMP High eligible","text":"Your artifact and supply chain controls support FedRAMP High eligibility. Comprehensive scanning, provenance, signing, and audit capabilities are all in place, positioning your team to support a formal FedRAMP authorization process."},{"id":"cra","eyebrow":"CRA","title":"CRA requirements met","text":"Your artifact and disclosure practices meet CRA requirements. SBOMs are generated and maintained per artifact version, vulnerability disclosure workflows are automated, and
1your supply chain documentation is ready for market surveillance review."},{"id":"dora","eyebrow":"DORA","title":"DORA requirements satisfied","text":"Your artifact and supply chain controls satisfy DORA\'s ICT risk management, patch management, and resilience requirements. You can provide financial sector customers with the third-party documentation and audit evidence DORA requires."},{"id":"s2c2f","eyebrow":"S2C2F","title":"S2C2F Level 4 achieved","text":"Your OSS consumption practices meet S2C2F Level 4. Critical dependencies are rebuilt from verified source, provenance is checked on upstream packages, and threat intelligence keeps your dependency governance continuously current."},{"id":"iso27001","eyebrow":"ISO 27001","title":"Full ISO 27001 certification ready","text":"Your artifact management and supply chain security practices demonstrate the depth, documentation, and automation required for full ISO 27001 certification across all relevant Annex A control domains."}]}],"footer":{"theme":{"backgroundColor":"var(--brand-color-purple-5)"}}},{"title":"5","themeColor":"var(--brand-color-blue-5)","label":"Optimized","hero":{"theme":{"backgroundColor":"var(--brand-color-blue-3)","sublineColor":"var(--brand-color-blue-7)","textColor":"var(--brand-color-blue-9)"},"subline":"Minimal exposure","description":"Hermetic builds, full attestation, continuous monitoring: your artifact supply chain is iron clad starting at the artifact layer."},"panels":[{"id":"artifact-management","title":"Artifact Management","icon":"artifact-management","layout":"vertical","text":["How you store, version, promote, and distribute binaries, packages, images, and ML models."],"items":[{"id":"artifact-storage-governance","eyebrow":"Artifact Storage & Repository Governance","title":"Fully automated, policy-driven governance","text":"Artifact governance is fully automated and enforced. All artifact operations are logged, access is scoped with least-privilege credentials, and your promotion workflows are policy-driven and auditable end-to-end."},{"id":"artifact-signing-integrity-verification","eyebrow":"Artifact Signing & Integrity Verification","title":"Automated signing, tampered artifacts rejected","text":"Cryptographic signing and signature verification are fully automated and enforced. Unsigned or tampered artifacts are automatically rejected before deployment, and your signing keys are managed and auditable."},{"id":"sbom-provenance","eyebrow":"SBOM & Provenance","title":"Signed provenance and version-specific SBOMs","text":"Every artifact has signed provenance and a version-specific SBOM immutably linked to its digest. Your attestation pipeline is fully automated, cryptographically verifiable, and ready for regulatory review."},{"id":"build-pipeline-integrity","eyebrow":"Build Pipeline Integrity","title":"Hermetic builds, SLSA L3","text":"Your builds are hermetic and isolated: no persistent state, network egress is restricted to your internal registry, and secrets are short-lived and build-scoped. Your pipeline meets SLSA L3 requirements."}]},{"id":"supply-chain-security","title":"Supply Chain Security","icon":"supply-chain-security","layout":"vertical","text":["Controls across your dependency graph: proxying, scanning, signing, policy management and protection against supply chain attacks."],"items":[{"id":"public-dependency-consumption","eyebrow":"Public Dependency Consumption","title":"Fully governed, continuously monitored","text":"External dependency consumption is fully governed: proxied, policy-enforced, and continuously monitored. New packages require automated health and policy checks before they can enter your build graph."},{"id":"vulnerability-management","eyebrow":"Vulnerability Management","title":"Automated CVE-to-remediation chain","text":"Vulnerability management is fully automated. CVE discovery triggers package quarantine, automated PRs, and tracked remediation with SLA enforcement and escalation policies, closing the gap between detection and remediation to days, not months."},{"id":"supply-chain-attack-protection","eyebrow":"Supply Chain Attack Protection","title":"Comprehensive, continuously monitored protection","text":"Supply chain attack protection is comprehensive and continuously monitored. OSS health scores are tracked automatically, alerts fire when depen
1dency health drops, and threat intelligence feeds keep your allowlists current."}]},{"id":"regulatory-alignment","title":"Regulatory Alignment","icon":"regulatory-framework-alignment","layout":"vertical","text":["Your auditability and compliance posture as it relates to visibility and governance of your supply chain."],"items":[{"id":"license-compliance","eyebrow":"License Compliance","title":"Fully automated, jurisdiction-aware enforcement","text":"License compliance is fully automated and enforced at every stage of your pipeline. Distribution rules can block specific packages by license type and jurisdiction, and your entire license inventory is continuously maintained and auditable."},{"id":"compliance-evidence-audit-readiness","eyebrow":"Compliance Evidence & Audit Readiness","title":"Real-time compliance monitoring","text":"Compliance monitoring is automated and real-time. Artifact metadata, SBOM data, and access logs are queryable in minutes, giving auditors and security teams instant access to the evidence they need."},{"id":"incident-response","eyebrow":"Incident Response","title":"Fully automated, regulatory-ready IR","text":"Supply chain incident response is fully automated and regulatory-ready. CVE detection triggers a complete response chain, from quarantine to customer notification, with DORA and CRA reporting timelines tracked automatically."}]},{"id":"framework-readiness","title":"Framework Readiness","icon":"framework-readiness","layout":"vertical","text":["How your current practices map to the specific controls, attestations, and documentation requirements of each major compliance framework."],"items":[{"id":"slsa","eyebrow":"SLSA","title":"SLSA L3 achieved","text":"Your build pipeline meets SLSA L3. Builds run in ephemeral, isolated environments; provenance is signed and logged to a transparency ledger; and the entire chain from source commit to deployed artifact is cryptographically verifiable."},{"id":"fedramp","eyebrow":"FedRAMP","title":"FedRAMP High eligible","text":"Your artifact and supply chain controls support FedRAMP High eligibility. Comprehensive scanning, provenance, signing, and audit capabilities are all in place, positioning your team to support a formal FedRAMP authorization process."},{"id":"cra","eyebrow":"CRA","title":"CRA requirements met","text":"Your artifact and disclosure practices meet CRA requirements. SBOMs are generated and maintained per artifact version, vulnerability disclosure workflows are automated, and
1your supply chain documentation is ready for market surveillance review."},{"id":"dora","eyebrow":"DORA","title":"DORA requirements satisfied","text":"Your artifact and supply chain controls satisfy DORA\'s ICT risk management, patch management, and resilience requirements. You can provide financial sector customers with the third-party documentation and audit evidence DORA requires."},{"id":"s2c2f","eyebrow":"S2C2F","title":"S2C2F Level 4 achieved","text":"Your OSS consumption practices meet S2C2F Level 4. Critical dependencies are rebuilt from verified source, provenance is checked on upstream packages, and threat intelligence keeps your dependency governance continuously current."},{"id":"iso27001","eyebrow":"ISO 27001","title":"Full ISO 27001 certification ready","text":"Your artifact management and supply chain security practices demonstrate the depth, documentation, and automation required for full ISO 27001 certification across all relevant Annex A control domains."}]}],"footer":{"theme":{"backgroundColor":"var(--brand-color-blue-5)"}}}]}}'))},672011,e=>{e.v(JSON.parse('{"feedbackForm":{"intro":"What would you like to report?","fields":{"email":{"label":"Email Address","placeholder":"Your email address","validation":{"required":"Your work email address is required","valid":"Please enter a valid email address"}},"message":{"label":"What would you like to report?","validation":{"required":"This field is required"}},"submit":{"label":"Submit"}},"error":{"title":"Weâre sorry, something went wrong submitting your feedback.","fallback":"But you can always contact us directly via email."},"success":{"title":"Youâre feedback has been submitted.","subline":"Thanks so much for your help making Cloudsmith Navigator better."}}}'))}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.