Public Sector Software Supply Chain Whitepaper

This whitepaper addresses the challenges and solutions related to securing the software supply chain within the public sector. It outlines the significance of the software supply chain in software development and details incidents that have highlighted vulnerabilities, such as the Solarwinds attack and the Log4J vulnerability. The document emphasizes the need for robust secure software supply chain tools and practices to enhance visibility and transparency, thereby mitigating risks associated with software supply chain attacks. The Cloud Native Public Sector User Group, formed in 2023, aims to improve public sector workflows and advocate for secure cloud-native software. The whitepaper discusses the importance of software registries and proposes a reference architecture for public sector organizations to adopt secure software supply chain practices. It also identifies common attack vectors and the necessity for compliance with standards like NIST, aiming to provide a framework that supports trust and transparency in software delivery processes.