microsoft / scim

Supply Chain Integrity Model

NOTE: The SCIM effort has a new name and location

• This site is now deprecated.
• Join us instead at https://github.com/ietf-scitt.

Overview

The Supply Chain Integrity Model (SCIM) supports the ongoing verification of artifacts, including hardware and software components, where the authenticity of entities, evidence, policy, and artifacts can be assured and the actions of entities can be guaranteed to be authorized, non-repudiable, immutable, and auditable. The proposed SCIM will be an industry standard specification, easing the path for uniform data flow across globally distributed supply chains.

SCIM aligns with an iterative approach to developing and implementing supply chain integrity requirements, allowing for enhancements over time based on evolving threat models and practices. A phased roll out of requirements promotes clarity for supplier planning and engineering and minimize disruptions.

Note: SCIM describes principles and a proposed model and system for conveying evidence. It does not address what evidence or information for attestation of conformity must be conveyed.

Workflow

The following diagram depicts the flow of artifacts, evidence and policies between entities in the Supply Chain Integrity Model.

A Supplier creates an Artifact (a). An Attester creates Evidence (b) and submits to a Store for logging, query, and retrieval. The Supplier and Attester may be the same entity. A Policy Manager creates Policy (c) and submits to a Store where it is recorded and made available for query and retrieval. A User Agent receives an Artifact, retrieves Evidence and Policy, and verifies the Artifact (d).

Example Application

The diagram below shows an example application of SCIM to the Software Development Lifecycle (SDLC).

Specifications

The table below maps proposed SCIM specifications to existing industry specifications.

SCIM	Existing
The SCIM-Evidence specification defines an extensible data model and exchange format for providing all types of evidence (bills of materials, build information, configuration settings, security assurances, certifications, vulnerabilities, end of life information) for all types of artifacts (hardware, software, services, machine learning models, etc.).	SWID, SPDX, CycloneDX, in-toto, RATS, and others
The SCIM-Policy specification defines a data model and exchange format for providing policy for use in evaluating artifacts for a specified use.	in-toto, RATS, and others
The SCIM-Store specification defines a rich, graph-aware storage API that allows read, write and query of Evidence and Policy.	DBOM, Grafeas, RATS, CCF and others

Roadmap

• Phase 1

  • Organizations use existing tools and specifications to begin implementing US Cyber EO Section 4 requirements, including SBOMs.
  • SCIM community organized for the development of end-to-end standards.

• Phase 2

  • Organizations begin adopting SCIM specifications, which encompass and extend existing initiatives.
  • SCIM specifications proposed to international standards bodies.

• Phase 3

  • SCIM specifications ratified by international standards bodies.
  • Widespread adoption of end-to-end model across globally distributed supply chains.

Contributing

Community Meetings:

• SCIM community meetings are held each Monday at 8:05 AM Pacific. Email [email protected] to be added to the meeting invitation.

Technical Meetings:

• SCIM technical meetings are held each Tuesday and Thursday at 8:00 AM Pacific. Email [email protected] to be added to the meeting invitation.

Meeting Agenda and Minutes (both community and technical meetings):

• https://docs.google.com/document/d/1vf-EliXByhg5HZfgVbTqZhfaJFCmvMdQuZ4tC-Eq6wg/edit?usp=sharing

Meeting Videos (both community and technical meetings):

• https://www.youtube.com/playlist?list=PL6EgWS5xrcg4J3vYdv9SL8MyZMp14DxBv

SCIM Vision

• https://docs.google.com/document/d/1UnpSIVJuw3dha3twRCzzwgeyul9qKNoAhQ1whfzUto0/edit?usp=sharing

scim's Issues

Double negative in the specification foreword.

Hi everyone! I'm a contributor to OmniBOR (formerly GitBOM) and noticed an issue regarding a double negative in a sentence about patent rights in the foreword of the OmniBOR spec, and some searching showed the same issue appears in the SCIM spec as well.

The sentence "No party shall not be held responsible for identifying any or all such patent rights." is found in the foreword and appears to be a possible transcription / editing error from the ISO template of the Rice model.

In the Rice model sample, it says: "ISO shall not be held responsible for identifying any or all such patent rights." You can view the PDF here (page 11).

Related issue for OmniBOR: omnibor/spec#38

Different Project Name? Conflicts with "System for Cross-domain Identity Management"

There's an existing standard SCIM used in the technology world of Identity & Access Management.

"System for Cross-domain Identity Management"
http://www.simplecloud.info/

This project name might be confusing for those who search for SCIM

Questions...

Can you explain how this approach, which is laid out in your roadmap differs from the classical MSFT model of proprietary influence on standards, to a predatory degree?

After a long winter in the context of software supply chain fidelity and provenance, we get a good start with Sigstore, and MSFT's ego/commercial goals, seem to supersede that. Is Satya aware of this approach?

This repo is missing important files

There are important files that Microsoft projects should all have that are not present in this repository. A pull request has been opened to add the missing file(s). When the pr is merged this issue will be closed automatically.

Microsoft teams can learn more about this effort and share feedback within the open source guidance available internally.

Merge this pull request

Figures are hard to read when in Dark mode

When using a dark theme the transparent background of the figures blends all the lines and black words into a black background. The result is black on black making the documents hard to read.

Could you not use transparent backgrounds in this scenario?