Supply-Chain Integrity

Go up to Terms and Definitions

Supply-Chain Integrity is the condition in which the identities, origins, versions, relationships, transformations, and content of supply-chain elements remain accurate, complete, authorized, and protected from unauthorized alteration.

The condition applies to source material, dependencies, tools, build processes, artifacts, manifests, signatures, evidence, transfer mechanisms, repositories, and associated Provenance.

Supply-Chain Integrity depends on controls such as Version Pinning, integrity verification, digital signatures, controlled repositories, change approval, access control, traceable transformations, and preservation of authoritative records.

Within Crucible, Supply-Chain Integrity supports confidence that the artifacts built, transferred, imported, and deployed correspond to the approved inputs and controlled processes recorded for them.

condition in which the identities, origins, versions, relationships, transformations, and content of supply-chain elements remain accurate, complete, authorized, and protected from unauthorized alteration

Generalized from cybersecurity, software supply-chain risk management, configuration management, provenance, and artifact-integrity usage and specialized for the Crucible architecture and operational model.

Supply-Chain Integrity does not establish that every supply-chain element is secure, defect-free, compliant, or suitable for its intended use. It establishes confidence that the elements and their relationships have not changed outside the applicable controls.

Integrity verification should apply both before and after transfer across an organizational, network, or Air Gap boundary.

An organization verifies the digests and signatures of a Transfer Bundle before export and again after import. The organization also compares the Dependency Manifest and provenance records to confirm that the imported content matches the approved captured supply chain.