Supply-Chain Briefing — Google and OpenSSF Introduce SLSA Framework

Executive briefing: On 21 June 2021 Google and the Open Source Security Foundation (OpenSSF) introduced the Supply-chain Levels for Software Artifacts (SLSA) framework. SLSA establishes four assurance levels that cover source controls, build system hardening, and tamper-evident provenance so organisations can mitigate supply-chain compromise risks exposed by attacks such as SolarWinds and dependency hijacking.

Framework highlights

• Levelled maturity. SLSA provides a staged roadmap from SLSA 1 (build provenance) through SLSA 4 (hermetic builds with two-person review) that teams can adopt iteratively.
• Provenance attestation. Build systems must emit signed metadata describing source revisions, dependencies, and builders, enabling downstream verification.
• Open reference tooling. The initiative released reference implementations and policy templates developers can adopt inside existing CI/CD platforms.

Implementation guidance

• Assess current posture. Inventory build pipelines, artifact repositories, and release processes to determine baseline alignment with SLSA requirements.
• Adopt provenance standards. Pilot Sigstore Fulcio/Rekor or in-house certificate authorities to sign artifacts and store tamper-resistant logs.
• Map to compliance controls. Link SLSA practices to SOC 2 CC8, FedRAMP SA-12, and ISO/IEC 27001 A.14 requirements covering code integrity and change management.

Enablement moves

• Educate development, release engineering, and security champions on SLSA levels, highlighting quick wins such as version-controlled builds and reproducibility.
• Work with procurement to request SLSA attestations from critical software suppliers.
• Embed SLSA checkpoints into internal SDLC policies, ensuring releases cannot proceed without signed provenance records.

Related briefings

Curated signals from the same pillar or overlapping topics.

Governance · Credibility 90/100 · April 13, 2023

Policy Briefing — CISA Secure-by-Design and Default Guidance Released

CISA’s secure-by-design guidance sets enforceable expectations for memory-safe development, default security controls, and transparent vulnerability management across the software supply chain.

Governance · Credibility 40/100 · June 3, 2021

Policy Briefing — Commission proposes eIDAS 2.0 digital identity framework

On 3 June 2021 the European Commission proposed an eIDAS 2.0 regulation creating EU Digital Identity Wallets and mandating high-assurance authentication for key public and private services.

Governance · Credibility 40/100 · May 18, 2021

Governance Briefing — May 18, 2021

OECD member countries adopted a refreshed Recommendation on Transparency and Integrity in Lobbying and Influence, widening disclosure expectations for policymakers, public bodies, and interest representatives.

Governance · Credibility 90/100 · August 6, 2021

Governance Briefing — August 6, 2021

The U.S. SEC approved Nasdaq’s board diversity rule on August 6, 2021, locking in new disclosure tables and minimum diverse-director expectations for most U.S.-listed companies.

Governance · Credibility 92/100 · May 5, 2021

Governance Briefing — May 5, 2021

India’s Securities and Exchange Board adopted the Listing Obligations and Disclosure Requirements (Third Amendment) Regulations on May 5, 2021, expanding board risk oversight, quorum, and compliance officer duties for…

Continue in the Governance pillar

Return to the hub for curated research and deep-dive guides.

Visit pillar hub

Latest guides

• Public-Sector Governance Alignment Playbook — Zeph Tech

  Align OMB Circular A-123, GAO Green Book, OMB M-24-10 AI guidance, EU public sector directives, and UK Orange Book with digital accountability, risk management, and service…

• Third-Party Governance Control Blueprint — Zeph Tech

  Deliver OCC, Federal Reserve, PRA, EBA, DORA, MAS, and OSFI third-party governance requirements through board reporting, lifecycle controls, and resilience evidence.

• Governance, Risk, and Oversight Playbook — Zeph Tech

  Operationalise board-level governance, risk oversight, and resilience reporting aligned with Basel Committee principles, ECB supervisory expectations, U.S. SR 21-3, and OCC…