Differences

This shows you the differences between two versions of the page.

--- public:99_annexes:annex-b-terms-and-definitions:s:supply-chain_integrity [2026/09/12 17:42] – removed - external edit (Unknown date) 127.0.0.1
+++ public:99_annexes:annex-b-terms-and-definitions:s:supply-chain_integrity [2026/09/12 17:43] (current) – ↷ Links adapted because of a move operation nick_dido
@@ Line 1: / Line 1: @@
+====== Supply-Chain Integrity ======
+[[public:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]]
+===== Discussion =====
+Supply-Chain Integrity is the condition in which the identities, origins, versions, relationships, transformations, and content of supply-chain elements remain accurate, complete, authorized, and protected from unauthorized alteration.
+The condition applies to source material, dependencies, tools, build processes, artifacts, manifests, signatures, evidence, transfer mechanisms, repositories, and associated [[public:99_annexes:annex-b-terms-and-definitions:p:provenance|Provenance]].
+Supply-Chain Integrity depends on controls such as [[public:99_annexes:annex-b-terms-and-definitions:v:version_pinning|Version Pinning]], integrity verification, digital signatures, controlled repositories, change approval, access control, traceable transformations, and preservation of authoritative records.
+Within Crucible, Supply-Chain Integrity supports confidence that the artifacts built, transferred, imported, and deployed correspond to the approved inputs and controlled processes recorded for them.
+===== Definition =====
+//condition in which the identities, origins, versions, relationships, transformations, and content of supply-chain elements remain accurate, complete, authorized, and protected from unauthorized alteration//
+===== Source =====
+Generalized from cybersecurity, software supply-chain risk management, configuration management, provenance, and artifact-integrity usage and specialized for the Crucible architecture and operational model.
+===== Note =====
+Supply-Chain Integrity does not establish that every supply-chain element is secure, defect-free, compliant, or suitable for its intended use. It establishes confidence that the elements and their relationships have not changed outside the applicable controls.
+Integrity verification should apply both before and after transfer across an organizational, network, or [[public:99_annexes:annex-b-terms-and-definitions:a:air_gap|Air Gap]] boundary.
+===== Example =====
+An organization verifies the digests and signatures of a Transfer Bundle before export and again after import. The organization also compares the Dependency Manifest and provenance records to confirm that the imported content matches the approved captured supply chain.
+----
+<WRAP centeralign>
+© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
+</WRAP>