A new publication called The Defending Against Software Supply Chain Attacks has been issued by CISA and the National Institute of Standards and Technology (NIST). It provides an overview of software supply chain issues and makes recommendations about how software customers and vendors can identify, assess, and mitigate software supply chain risks. The publication also provides practical guidance associated with the use of the NIST’s Cyber Supply Chain Risk Management (C-SCRM) framework and the Secure Software Development Framework (SSDF).

The publication can be found here: https://www.cisa.gov/publication/software-supply-chain-attacks