How mature is your open-source risk management? S2C2F helps map out dependencies

The Secure Supply Chain Consumption Framework (S2C2F) from the Open Source Security Foundation (OpenSSF) is a useful resource for enterprise software teams addressing risks from open-source dependencies.

The framework provides a structured list of guidelines and best practices to protect development organizations from consuming vulnerable and compromised open-source software (OSS) components. It enumerates real-world open-source risks and recommends processes for identifying, evaluating, and monitoring them throughout the software development lifecycle (SDLC).

Microsoft developed the framework and used it for …

best practices compromised consuming dependencies development enterprise enterprise software foundation framework guidelines list management map open source open source security open source security foundation openssf organizations practices protect resource risk risk management risks s2c2f secure supply chain security security foundation software supply supply chain teams the open source security foundation vulnerable