# Software Supply Chain Security Assessment

> From $36K · Specialized & Industry · https://cisomarketplace.services/services/software-supply-chain-security

Comprehensive evaluation of your organization's software supply chain security posture, examining third-party dependencies, build processes, and deployment pipelines. Our assessment identifies vulnerabilities in your software supply chain and provides strategies to mitigate risks from compromised components, malicious packages, and insecure development practices.

## In scope

- Third-party dependency review
- Build pipeline security assessment
- Code signing practices
- Package repository security
- Provenance verification
- CI/CD security controls
- Container image security
- Dependency vulnerability management
- SBOM generation and management
- Artifact signing process evaluation
- Container and base-image security analysis

## Deliverables

- Software supply chain risk assessment report
- Dependency security analysis
- Build pipeline security recommendations
- SBOM implementation strategy
- Code signing framework
- Repository security controls
- Vulnerability management process
- Regulatory compliance guidance

## Tiers

### Essential Supply Chain Security Review: $36K

Up to 10 repositories, 1 CI/CD platform and up to 25 developers: third-party dependency review of critical applications, build pipeline and CI/CD control review, package repository settings, and code signing practices. Risk report.

Limits: repositories 10, developers 25

Includes:
- Up to 10 repositories
- Dependency review of critical applications
- Build pipeline and CI/CD control review
- Package repository security review
- Code signing practice review
- Risk assessment report

Excludes:
- SBOM generation and implementation
- Container image security
- Provenance verification
- Governance framework

### Comprehensive Supply Chain Security Program: $65K

Up to 25 repositories, up to 3 CI/CD platforms and up to 100 developers: all nine scope areas including container images and provenance verification, SBOMs generated for in-scope applications, and a dependency vulnerability management process.

Limits: repositories 25, developers 100

Includes:
- Up to 25 repositories
- All nine scope areas
- SBOM generation and implementation strategy
- Container image security
- Provenance verification
- Vulnerability management process

Excludes:
- Automated policy gates built into pipelines
- Governance framework
- Regulatory compliance mapping

### Enterprise Supply Chain Security Framework: $95K

Up to 100 repositories and up to 250 developers: Standard scope plus automated controls (dependency, signing and SBOM gates) implemented in pipelines, a supply chain governance framework, and mapping to the customer's named regulatory requirements.

Limits: repositories 100, developers 250

Includes:
- Up to 100 repositories
- Automated pipeline gates implemented
- Governance framework
- Code signing framework
- Regulatory compliance guidance

Excludes:
- Tool licence costs
- Ongoing managed monitoring
- Application source code review for vulnerabilities

## Terms

Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW.

Scope this engagement: https://cisomarketplace.services/scope?service=software-supply-chain-security