Supply Chain Security Maturity Assessment

Software supply chain security maturity is not a single dimension , it spans multiple distinct capability domains that can have widely varying maturity levels within the same programme. An enterprise with a mature SBOM programme, a strong SCA implementation, and active vulnerability monitoring may simultaneously have no awareness of SLSA, no build pipeline security assessment capability, and no supply chain incident response playbook. Assessing supply chain security maturity requires a domain-specific evaluation , rating each capability area independently rather than producing a single aggregate score that averages strong domains with absent ones.

The supply chain security maturity domains relevant to TPRM programmes span six areas: dependency management (SCA scanning, SBOM collection, vulnerability monitoring, VEX handling), build security (SLSA awareness, build pipeline assessment, provenance verification), artifact security (signing verification, registry security, immutability), distribution security (update mechanism assessment, provenance verification), monitoring and detection (supply chain monitoring, CI/CD security posture management), and incident response (supply chain IR playbook, affected release identification, customer notification). Each domain can be rated independently from Level 0 (unaware/absent) through Level 4 (proactive, automated, continuously improving).

The self-assessment accuracy problem is the specific maturity model challenge. Supply chain security maturity self-assessments tend to cluster around the domains where investment has been made , rating SBOM and SCA highly because those are the domains the programme has focused on, without acknowledging the domains that have not been addressed. The consultant's external assessment in the hook scenario revealed that the enterprise's self-rating of Level 3 reflected their SBOM and SCA investment without accounting for the Level 1 and Level 0 domains that those investments had not addressed.

Why this matters

Supply chain security maturity assessment matters for TPRM because it provides the domain-specific picture of where supply chain security investment has been made and where the gaps are , which directly informs both internal programme improvement prioritisation and the questions that TPRM teams should ask of vendors about the specific domains where gap is most likely.

• Single aggregate maturity score obscuring domain variation
• High-investment domains rated high , absent domains not acknowledged
• No domain-specific maturity framework for supply chain security
• SBOM/SCA investment conflated with complete supply chain security maturity
• Maturity assessment not used to prioritise programme investment

What good looks like

Mature supply chain security maturity assessments rate six domains independently , dependency management, build security, artifact security, distribution security, monitoring, and incident response , present domain-specific ratings rather than aggregate scores, and use the ratings to prioritise investment in the lowest-maturity domains.

• Six-domain supply chain maturity assessment
• Independent domain ratings , not aggregate score
• Lowest-maturity domain prioritisation for investment
• Annual maturity reassessment to track progress
• Independent validation , external assessment to calibrate self-ratings

Tooling

Maturity Reference , OpenSSF Scorecard for open-source dependency security scoring; CISA C-SCRM maturity model for supply chain programme maturity

The OpenSSF Scorecard provides automated supply chain security assessment across multiple dimensions for open-source projects , including branch protection, dependency pinning, code review, CI security, and vulnerability management. CISA's C-SCRM maturity model provides the enterprise-level supply chain security maturity framework. Both provide structured domain-specific assessment that supplements self-evaluation with external signal.

Governance challenges

The governance challenge with supply chain security maturity assessment is the unknown unknowns problem. Domains that are absent from a programme's awareness cannot be self-assessed accurately , the enterprise that has never heard of SLSA cannot rate its SLSA maturity other than Level 0. The governance resolution is using external maturity frameworks , NIST 800-161 Appendix E, OpenSSF Scorecard, CISA C-SCRM , as the domain inventory, ensuring that all domains are at least evaluated even if currently at Level 0.

• Use external domain inventory , NIST 800-161, OpenSSF, CISA for complete domain list
• Rate all domains including absent ones , Level 0 is a valid and important rating
• Independent external assessment to calibrate self-ratings
• Investment prioritisation driven by domain-specific gaps
• Annual reassessment using consistent domain framework

If you are a small team

Score your supply chain security programme across the six core domains on a 0-4 scale: dependency management (SCA, SBOM, VEX), build security (SLSA, pipeline assessment), artifact security (signing, registry), distribution security (update mechanism), monitoring (supply chain monitoring), and incident response (supply chain IR playbook). Score honestly , Level 0 for domains you have not addressed is better information than an inflated aggregate. The lowest scores identify your highest-priority investment areas.

• Score six supply chain security domains on 0-4 scale
• Rate absent domains as Level 0 , not 'not applicable'
• Prioritise investment in lowest-scoring domains
• Validate self-scores with external assessment

What to require

Ask directly:

"Can you provide a domain-specific supply chain security maturity self-assessment , covering dependency management, build security, artifact security, distribution security, monitoring, and incident response , with independent ratings for each domain rather than an aggregate score?"

Expect as evidence

• Domain-specific maturity ratings for six supply chain security domains
• Level 0 acknowledgment for absent domains rather than N/A
• Investment roadmap for lowest-maturity domains
• External validation of self-assessment ratings

A vendor who confirms supply chain security programme maturity should be asked for domain-specific ratings. Aggregate maturity describes the average across domains. Domain-specific ratings reveal where the programme is strong and where the gaps are that the average conceals.

How to evidence it

• Domain-specific maturity assessment records
• Level 0 domain identification and remediation roadmap
• Investment prioritisation based on maturity gaps
• Annual maturity reassessment

Key Takeaway

SBOM: Level 3. SCA: Level 3. SLSA: Level 0, unaware. Build pipeline security: Level 1. Supply chain monitoring: Level 0. Self-assessment: Level 3 based on SBOM and SCA. External assessment: Level 2 with Level 3 practices in two of six domains. The aggregate obscured the variation. Domain-specific assessment revealed the complete picture: strong where invested, absent where not. Level 0 for supply chain monitoring and SLSA is a more actionable finding than Level 3 aggregate. Investment prioritisation driven by the lowest-maturity domains produces better supply chain security outcomes than investment in already-mature domains.

More on Third-party oversight

• Build Pipeline Integrity
• Vendor Patch Cadence Reality
• Artifact Registry Security