Supply-chain Levels for Software Artifacts
OpenSSF framework defining progressive levels of build-system integrity for software supply chain security, focused on tamper-resistance of the build.
Definition
SLSA (Supply-chain Levels for Software Artifacts) is an Open Source Security Foundation (OpenSSF) specification that defines four progressive maturity levels for the integrity of a software build process. Each level adds requirements: SLSA Level 1 asks for a scripted build and provenance; Level 2 requires a hosted build service that generates signed provenance; Level 3 requires the build environment to be hardened and non-falsifiable; Level 4 (still evolving) requires a hermetic, two-person-reviewed build. SLSA's contribution is provenance, verifiable attestations of how, where, and from what sources an artifact was built.What this means in practice
SLSA complements SBOM. An SBOM tells you what is inside an artifact; SLSA provenance tells you whether the artifact was built from the sources it claims, in a build environment that wasn't tampered with. For medical device manufacturers concerned about XZ-Utils-style supply-chain compromises, SLSA Level 2+ for first-party builds and SLSA-verifiable provenance from upstream component suppliers is the strongest available defense.- •Equating SBOM with supply-chain security, without provenance, an SBOM can be fabricated.
- •Targeting SLSA Level 4 immediately, most organizations start at Level 1-2 and progress as their build infrastructure matures.
- •Ignoring third-party SLSA provenance when selecting components, the framework's value compounds when consumed and produced.
Related terms
Grouped by themeEditor's picks
· Hand-selected related conceptsA lightweight, OWASP-maintained SBOM format designed for application security and supply-chain use cases.
A documented, risk-based set of processes that build cybersecurity into a medical device across its full lifecycle.
NIST SP 800-218, a framework of secure software development practices that is referenced by EO 14028 and increasingly by medical device guidance.
A machine-readable inventory of all software components, including open-source and third-party libraries, used to build a medical device.
More in Cybersecurity
· Same categoryAn open SBOM and license-data format published as ISO/IEC 5962:2021.
A machine-readable statement that explains whether a known vulnerability is actually exploitable in a specific product.
AAMI/ANSI standard establishing requirements for medical-device cybersecurity activities throughout the lifecycle.
AAMI Technical Information Report providing MedTech-specific guidance on cybersecurity risk management.
Primary references
3 sources- 1
SLSA SpecificationVerifiedOpenSSFslsa.dev
- 2
CISA - Healthcare and Public Health SectorVerifiedCISAcisa.gov
- 3
FDA - Cybersecurity for Medical DevicesVerifiedFDAfda.gov
Inline markers like [1] jump to the matching reference above.