S2C2F
Secure Supply Chain Consumption Framework
Secure Supply Chain Consumption Framework, an OpenSSF framework for consuming open-source software safely. It groups its requirements into eight practices (ingest, scan, inventory, update, audit, enforce, rebuild, and fix and upstream) and four maturity levels.
Covered in
Adopt the OpenSSF S2C2F as a consumer: the eight practices, the four maturity levels and a staged plan with evidence
Assess how your organization takes in open source against the Secure Supply Chain Consumption Framework's 25 requirements, then reach each maturity level in turn with evidence an assessor can check.
Protect the source repository: rulesets, reviews and signed commits
Configure the controls every repository that ships software needs: protected branches and tags, required review with CODEOWNERS, signed commits, secret push protection and account security, mapped to the SLSA Source track, the OpenSSF OSPS Baseline and Scorecard.