Active

Supply Chain Framework

The organization shall establish a software supply chain security framework that defines the structures, processes, and practices for securing the software supply chain. The framework shall articulate how third-party components are managed, how open source security is addressed, and how supply chain security is governed, providing the foundation for all software supply chain security activities.

Requirement ID
APP-007-R001
Parent Control
APP-007
Domain Code
APP

Requirement Details & Guidance

APP-007-R001 · APP-007
Why This Requirement Exists

Third-party libraries, packages, build tools, and artifacts can introduce vulnerabilities or malicious components into applications.

Implementation Guidance

Maintain dependency inventories, evaluate third-party components, use trusted repositories, verify artifacts where appropriate, and monitor dependencies for newly disclosed vulnerabilities.

Practical Application & Audit Readiness

APP-007-R001 · Field Guidance

Business Examples

    Common Audit Findings

      Common Mistakes

        Best Practices & Ownership

        APP-007 · Recommended Approach

        Recommended Practices

          Typical Owner

          Cross-Mapped Regulatory Frameworks

          Harmonized Control Mappings
          FRAMEWORK CODE FRAMEWORK NAME & DETAILS FAMILY / CATEGORY VERSION ACTION
          CIS-V8 CIS Controls CIS Controls are a prioritized set of cybersecurit... Clause: Control 16 – Application Software Security: 16.4 – Establish and Manage an Inventory of Third-Party Software Components; 16.5 – Use Up-to-Date and Trusted Third-Party Software Components
          CIS
          Best Practice
          		 vv8 View →
          DORA Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 7 – ICT systems, protocols and tools Article 8(2) – Continuous identification of ICT risk sources, cyber threats and ICT vulnerabilities
          EU
          Regulation
          		 vCurrent View →
          GDPR General Data Protection Regulation (GDPR) The General Data Protection Regulation is a bindin... Clause: Article 28(1) – Processor requirements; Article 32(2) – Risk-based security measures
          EU
          Regulation
          		 vCurrent View →
          HIPAA Health Insurance Portability and Accountability Act HIPAA is a U.S. federal law supported by implement... Clause: § 164.308(b)(1)-(3) Business associate contracts and other arrangements
          US
          Law
          		 vCurrent View →
          IRDAI IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §2.5-3.1.2 – Application security standards; §2.14-3.1 – Vendor IS classification
          India
          Guideline
          		 vLatest View →
          ISO27002 ISO/IEC 27002 ISO/IEC 27002 is a guidance standard containing a... Clause: 5.21 – Managing information security in the ICT supply chain
          ISO
          Standard
          		 v2022 View →
          NIS2 NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 21(2)(d) – Supply chain security, including relationships with direct suppliers/service providers Article 21(3) – Supplier vulnerabilities, product/cybersecurity quality and secure development; critical supply-chain risk assessment results
          EU
          Directive
          		 vCurrent View →
          NIST-CSF NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: PR.PS – Platform Security | PR.PS-06 – Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle PR.PS – Platform Security | PR.PS-01 – Configuration management practices are established and applied DE.CM – Continuous Monitoring | DE.CM-09 – Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events
          NIST
          Framework
          		 v2 View →
          NIST80053 NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.17 – SYSTEM AND SERVICES ACQUISITION, 3.20 – SUPPLY CHAIN RISK MANAGEMENT; SA-12 – SUPPLY CHAIN PROTECTION, SR-4 – PROVENANCE
          NIST
          Control Catalog
          		 vRev. 5 View →
          NPCI-ISR NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Security Measures / Controls; Application Security Life Cycle
          India
          Standard
          		 vLatest View →
          PCI-DSS PCI DSS PCI DSS is an industry security standard maintaine... Clause: 6.1.1 – All security policies and operational procedures that are identified in Requirement 6 are documented, kept up to date, in use, and known to all affected parties.; 6.2.1 – Bespoke and custom software are developed
          PCI
          Standard
          		 v4 View →
          RBI-CSF RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: 6) Application Security Life Cycle (ASLC) – 6.1 Information security across all application lifecycle stages; 6) Application Security Life Cycle (ASLC) – 6.2 Source-code audit or assurance of critical applications
          India
          Regulation
          		 vLatest View →
          SEBI-CSCRF SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 1.6 GV.SC: Cybersecurity Supply Chain Risk Management
          India
          Regulation
          		 vLatest View →
          SOC2 SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC9.2 – Risk Mitigation – The entity assesses and manages risks associated with vendors and business partners.
          AICPA
          Audit Framework
          		 vLatest View →

          Parent Domain Context

          Governance Domain Baseline
          Domain Name:
          Application Security (APP)
          Purpose:
          To ensure the security of internally developed and acquired applications.
          Scope:
          Enterprise
          View

          Parent Control Context

          Control Baseline
          Control Name:
          Software Supply Chain Security (APP-007)
          Summary:
          Establishes software supply chain security including SBOM management, third-party component management, open-source security, dependency management, component verification, monitoring, reporting, and continuous improvement.
          Business Description:
          Establish and maintain controls to identify, assess, monitor, and manage security risks associated with software components, open-source software, third-party libraries, package repositories, and software suppliers.
          View