Supply Chain Risk Score

Composite score: PURL, hash, supplier, license, version coverage.


Short name	SC Risk
Region	Internal
Country or scope	Internal
Sector	Supply Chain
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers SC Risk

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 8 controls from Safeguard's control catalog for SC Risk.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for SC Risk and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`SCR-PURL` PURL Coverage	Components should carry Package URLs so they can be unambiguously resolved across ecosystems and tooling (NTIA Minimum Elements: 'Other Unique Identifiers'; PURL specification)	Scan
`SCR-HASH` Hash Coverage	Components should carry cryptographic hashes enabling integrity verification of shipped artifacts (CISA SBOM guidance; SPDX checksums / CycloneDX hashes)	Scan
`SCR-SUPPLIER` Supplier Coverage	Each component should name its supplier, the baseline datum for assessing supplier concentration and trust (NTIA Minimum Elements: 'Supplier Name')	Scan
`SCR-LICENSE` License Coverage	Components should carry license information to expose legal supply chain risk alongside security risk (SPDX license fields; CycloneDX licenses)	Scan
`SCR-VERSION` Version Coverage	Each component should record its version, without which no vulnerability or update posture can be computed (NTIA Minimum Elements: 'Version of the Component')	Scan
`SCR-GRAPH` Dependency Graph Present	Dependency relationships should be documented so transitive exposure can be traced from any affected component (NTIA Minimum Elements: 'Dependency Relationship')	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`SCR-01`	Composite Risk Score Inputs
`SCR-02`	Supplier Tiering
`SCR-03`	Single-Source Risk Detection
`SCR-04`	Geographic Risk Flagging
`SCR-05`	Supplier Contact & SLA Capture
`SCR-06`	Open-Source Abandoned Project Detection
`SCR-07`	Software Bill of Materials Sharing with Customers
`SCR-08`	Registry Integrity Verification

Policy templates

Written for SC Risk:

Third-Party Software Supplier Risk Management Policy
Open-Source Component Intake and Registry Integrity Policy
SBOM Customer Sharing and Transparency Policy

And 22 from the standard set, adapted to SC Risk.