Standard

Software Composition Analysis Standard

This standard defines the requirements for Software Composition Analysis (SCA) across all software development, evaluation, and procurement activities. SCA identifies, tracks, and manages the security and licensing risks introduced by open-source components, third-party libraries, and their transitive dependencies.

Type

Standard

Version

1.1.21

Date

2026-10-27

Owner

Chief Information Security Officer

Approving authority

Governance Library Maintainer

Classification

Public

Confidentiality

Public

Category

Developer Security: Software Supply Chain

Review frequency

6 to 12 months and upon material tooling change, significant supply chain incident, or new regulatory guidance on SBOM or software provenance

Licence

CC BY-SA 4.0

Read the full text on GitHub → (opens in a new tab)

Outline

• 1. Purpose
• 2. Scope
• 3. Definitions
• 4. SCA requirements
• 5. Roles and responsibilities
• 6. Metrics
• 7. Framework and regulatory alignment

Frameworks it maps to

• NIST SSDF (SP 800-218 Version 1.1)
• NIST SP 800-53 Rev. 5
• US Executive Order 14028
• EU Cyber Resilience Act (CRA)
• SLSA v1.2 Framework
• OWASP Dependency-Check
• CycloneDX / SPDX
• ISO/IEC 27002:2022
• NIST CSF 2.0

Related documents

• dev-security/README.md (opens in a new tab)source
• Secure Development and Engineering Policydev-security
• Developer Security Requirementsdev-security
• DevOps Security Requirementsdev-security
• Software Evaluation, Acceptance and Lifecycle Management Standarddev-security
• Quality Assurance and Testing Standarddev-security
• Compliance Controls and Gap Register Templatedev-security
• Acceptance Into Service Policysecurity
• Third-Party and Supply Chain Risk Standardrisk
• Compliance, Audit, and CAPA Management Policycompliance