--- title: "SLSA Definition & Meaning | MedTech Terms" description: "OpenSSF framework defining progressive levels of build-system integrity for software supply chain security, focused on tamper-resistance of the build." lang: en json-ld: | { "@context": "https://schema.org", "@graph": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/slsa#term", "name": "Supply-chain Levels for Software Artifacts", "alternateName": "SLSA", "description": "SLSA (Supply-chain Levels for Software Artifacts) is an Open Source Security Foundation (OpenSSF) specification that defines four progressive maturity levels for the integrity of a software build process. Each level adds requirements: SLSA Level 1 asks for a scripted build and provenance; Level 2 requires a hosted build service that generates signed provenance; Level 3 requires the build environment to be hardened and non-falsifiable; Level 4 (still evolving) requires a hermetic, two-person-reviewed build. SLSA's contribution is provenance, verifiable attestations of how, where, and from what sources an artifact was built.", "url": "https://medtechterms.com/terms/slsa", "termCode": "slsa", "inDefinedTermSet": { "@type": "DefinedTermSet", "name": "MedTech Terms", "url": "https://medtechterms.com/terms" } }, { "@type": "Article", "@id": "https://medtechterms.com/terms/slsa#article", "headline": "SLSA, Supply-chain Levels for Software Artifacts", "description": "OpenSSF framework defining progressive levels of build-system integrity for software supply chain security, focused on tamper-resistance of the build.", "url": "https://medtechterms.com/terms/slsa", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://medtechterms.com/terms/slsa" }, "about": { "@id": "https://medtechterms.com/terms/slsa#term" }, "articleSection": "Cybersecurity", "inLanguage": "en", "keywords": "Supply-chain Levels for Software Artifacts, SLSA, Cybersecurity, medical device, MedTech", "author": { "@type": "Person", "name": "Christian Espinosa", "jobTitle": "Founder, Blue Goat Cyber", "url": "https://bluegoatcyber.com" }, "publisher": { "@type": "Organization", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "isPartOf": { "@type": "WebSite", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "datePublished": "2026-06-20", "dateModified": "2026-06-20", "citation": [ { "@type": "CreativeWork", "name": "SLSA Specification", "url": "https://slsa.dev/", "publisher": { "@type": "Organization", "name": "OpenSSF" } }, { "@type": "CreativeWork", "name": "CISA - Healthcare and Public Health Sector", "url": "https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/healthcare-and-public-health-sector", "publisher": { "@type": "Organization", "name": "CISA" } }, { "@type": "CreativeWork", "name": "FDA - Cybersecurity for Medical Devices", "url": "https://www.fda.gov/medical-devices/digital-health-center-excellence/cybersecurity", "publisher": { "@type": "Organization", "name": "FDA" } } ], "mentions": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/sbom#term", "name": "Software Bill of Materials", "alternateName": "SBOM", "url": "https://medtechterms.com/terms/sbom" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/ssdf#term", "name": "Secure Software Development Framework", "alternateName": "SSDF", "url": "https://medtechterms.com/terms/ssdf" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/spdf#term", "name": "Secure Product Development Framework", "alternateName": "SPDF", "url": "https://medtechterms.com/terms/spdf" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/vex#term", "name": "Vulnerability Exploitability eXchange", "alternateName": "VEX", "url": "https://medtechterms.com/terms/vex" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/cyclonedx#term", "name": "CycloneDX", "url": "https://medtechterms.com/terms/cyclonedx" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/spdx#term", "name": "SPDX", "alternateName": "SPDX", "url": "https://medtechterms.com/terms/spdx" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/secure-by-design#term", "name": "Secure-by-Design (Devices)", "url": "https://medtechterms.com/terms/secure-by-design" } ] }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://medtechterms.com/" }, { "@type": "ListItem", "position": 2, "name": "Terms", "item": "https://medtechterms.com/terms" }, { "@type": "ListItem", "position": 3, "name": "Cybersecurity", "item": "https://medtechterms.com/terms?cat=Cybersecurity" }, { "@type": "ListItem", "position": 4, "name": "Supply-chain Levels for Software Artifacts", "item": "https://medtechterms.com/terms/slsa" } ] } ] } --- [ MedTech Terms The authoritative reference ](/) Browse Learn [Latest](/latest) About 1. [Home](/) 2. / 3. [Terms](/terms) 4. / 5. [Cybersecurity](/terms?cat=Cybersecurity) 6. / 7. Supply-chain Levels for Software Artifacts [All terms](/terms) Cybersecurity [Connected & Cyber-Physical Devices](/ecosystems/connected-devices)[Software Lifecycle](/ecosystems/software-lifecycle)SLSA /salsa/ # Supply-chain Levels for Software Artifacts OpenSSF framework defining progressive levels of build-system integrity for software supply chain security, focused on tamper-resistance of the build. Reviewed by [Christian Espinosa, Founder, Blue Goat Cyber](/authors/christian-espinosa) Last reviewed June 20, 2026 ## Definition SLSA (Supply-chain Levels for Software Artifacts) is an Open Source Security Foundation (OpenSSF) specification that defines four progressive maturity levels for the integrity of a software build process. Each level adds requirements: SLSA Level 1 asks for a scripted build and provenance; Level 2 requires a hosted build service that generates signed provenance; Level 3 requires the build environment to be hardened and non-falsifiable; Level 4 (still evolving) requires a hermetic, two-person-reviewed build. SLSA's contribution is provenance, verifiable attestations of how, where, and from what sources an artifact was built. What the regulation says Not yet directly cited by FDA, but referenced by CISA's Software Supply Chain Security guidance and accepted as evidence under [NIST SSDF](/terms/ssdf) practice PS.3 (Verify Third-Party Software) and PO.3 (Implement Supporting Toolchains). Expect SLSA references to appear in future FDA cybersecurity guidance updates. ## What this means in practice SLSA complements [SBOM](/terms/sbom). An SBOM tells you what is inside an artifact; SLSA provenance tells you whether the artifact was built from the sources it claims, in a build environment that wasn't tampered with. For medical device manufacturers concerned about XZ-Utils-style supply-chain compromises, SLSA Level 2+ for first-party builds and SLSA-verifiable provenance from upstream component suppliers is the strongest available defense. Common pitfalls - • Equating SBOM with supply-chain security, without provenance, an SBOM can be fabricated. - • Targeting SLSA Level 4 immediately, most organizations start at Level 1-2 and progress as their build infrastructure matures. - • Ignoring third-party SLSA provenance when selecting components, the framework's value compounds when consumed and produced. ## Related terms Grouped by theme ### Editor's picks · Hand-selected related concepts [ Cybersecurity CycloneDX A lightweight, OWASP-maintained SBOM format designed for application security and supply-chain use cases. ](/terms/cyclonedx)[ Cybersecurity Secure Product Development Framework(SPDF) A documented, risk-based set of processes that build cybersecurity into a medical device across its full lifecycle. ](/terms/spdf)[ Cybersecurity Secure Software Development Framework(SSDF) NIST SP 800-218, a framework of secure software development practices that is referenced by EO 14028 and increasingly by medical device guidance. ](/terms/ssdf)[ Cybersecurity Software Bill of Materials(SBOM) A machine-readable inventory of all software components, including open-source and third-party libraries, used to build a medical device. ](/terms/sbom) ### More in Cybersecurity · Same category [ Cybersecurity SPDX(SPDX) An open SBOM and license-data format published as ISO/IEC 5962:2021. ](/terms/spdx)[ Cybersecurity Vulnerability Exploitability eXchange(VEX) A machine-readable statement that explains whether a known vulnerability is actually exploitable in a specific product. ](/terms/vex)[ Cybersecurity AAMI SW96 AAMI/ANSI standard establishing requirements for medical-device cybersecurity activities throughout the lifecycle. ](/terms/aami-sw96)[ Cybersecurity AAMI TIR57 AAMI Technical Information Report providing MedTech-specific guidance on cybersecurity risk management. ](/terms/aami-tir57) Cited by Where this term appears across MedTech Terms. Ecosystems (2) - [Connected & Cyber-Physical Devices](/ecosystems/connected-devices) - [Software Lifecycle](/ecosystems/software-lifecycle) ## Primary references 3 sources Link health: 3 verified · last checked 2026-06-20 OpenSSF· 1 CISA· 1 FDA· 1 1. [1 SLSA Specification Verified OpenSSF · slsa.dev ](https://slsa.dev/) 2. [2 CISA - Healthcare and Public Health Sector Verified CISA · cisa.gov ](https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/healthcare-and-public-health-sector) 3. [3 FDA - Cybersecurity for Medical Devices Verified FDA · fda.gov ](https://www.fda.gov/medical-devices/digital-health-center-excellence/cybersecurity) Inline markers like \[1\] jump to the matching reference above. Sponsor note ### Working on medical device cybersecurity? Blue Goat Cyber specializes in MedTech cybersecurity - threat modeling, SBOMs, penetration testing, and FDA premarket submissions. [Book a 30-minute discovery session](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) - No obligation - Expert-led from minute one - NDA available on request MedTech Terms is a community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com). Definitions are independent of any vendor. On this term Category Cybersecurity Acronym SLSA Sources 3 Updated 6/20/2026 [Compare with another term](/compare?a=slsa) Learn in 60 seconds Card Lesson Quiz OpenSSF framework defining progressive levels of build-system integrity for software supply chain security, focused on tamper-resistance of the build. - · SLSA complements SBOM. - · An SBOM tells you what is inside an artifact; SLSA provenance tells you whether the artifact was built from the sources it claims, in a build environment that wasn't tampered with. - · SLSA's contribution is provenance, verifiable attestations of how, where, and from what sources an artifact was built. Remember this Watch out: Equating SBOM with supply-chain security, without provenance, an SBOM can be fabricated. Related terms - [Software Bill of Materials(SBOM) ](/terms/sbom) - [Secure Software Development Framework(SSDF) ](/terms/ssdf) - [Secure Product Development Framework(SPDF) ](/terms/spdf) - [Vulnerability Exploitability eXchange(VEX) ](/terms/vex) - [CycloneDX ](/terms/cyclonedx) - [SPDX(SPDX) ](/terms/spdx) - [Secure-by-Design (Devices) ](/terms/secure-by-design) You may also need Auto-suggested from Cybersecurity and shared keywords. - [HITRUST CSF(HITRUST) ](/terms/hitrust) - [SOC 2 ](/terms/soc-2) - [STRIDE Threat Model(STRIDE) ](/terms/stride) - [Threat Modeling ](/terms/threat-modeling) - [HIPAA(HIPAA) ](/terms/hipaa) - [Coordinated Vulnerability Disclosure(CVD) ](/terms/cvd) [All Cybersecurity terms](/terms?cat=Cybersecurity) From the Blue Goat network Related resources and services on this topic. - [ MedTech Cybersecurity Standards Authoritative reference for the standards and guidances behind medical device cybersecurity. ](https://medtechcyberstandards.com) - [ MedTech Cyber Tips Practical, organized tips for medical device cybersecurity teams. ](https://medtechcybertips.com) - [ MedTech Cybersecurity Crosswalk International crosswalk of medical device cybersecurity requirements across regulators. ](https://mdccrosswalk.com) - [ Code Blue Real medical device cybersecurity incidents and their lessons. ](https://codebluechart.com) MedTech Terms An authoritative, plain-language reference for the regulatory, quality, cybersecurity, and software terms that shape modern medical devices. Browse - [All terms](/terms) - [A–Z index](/a-z) - [Categories](/categories) - [Ecosystems](/ecosystems) - [Learning paths](/paths) - [Compare terms](/compare) - [Quiz](/quiz) Resources - [FDA Medical Devices](https://www.fda.gov/medical-devices) - [EU MDR](https://eur-lex.europa.eu/eli/reg/2017/745/oj) - [IMDRF](https://www.imdrf.org/) - [Methodology](/methodology) - [Changelog](/changelog) - [Editor: Christian Espinosa](/authors/christian-espinosa) - [About this site](/about) © 2026 MedTech Terms. Reference content for educational purposes - not regulatory advice. A community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com)