---
description: Navigation catalog and consolidated attribution for the supply chain security skill reference set
---

# Supply Chain Security Reference Index

This index catalogs every reference file in the supply chain security skill. Each reference holds a verbatim standard catalog or classification taxonomy used during supply chain posture assessment, gap analysis, and backlog derivation.

## Standards catalogs

| Reference                                          | Topic                                                         |
|----------------------------------------------------|---------------------------------------------------------------|
| [openssf-scorecard.md](openssf-scorecard.md)       | OpenSSF Scorecard 20 checks with risk levels and score ranges |
| [slsa-levels.md](slsa-levels.md)                   | SLSA v1.0 Build track levels L0 through L3                    |
| [best-practices-badge.md](best-practices-badge.md) | OpenSSF Best Practices Badge Passing, Silver, and Gold tiers  |
| [sigstore-maturity.md](sigstore-maturity.md)       | Sigstore (cosign) adoption maturity levels                    |
| [sbom-elements.md](sbom-elements.md)               | NTIA SBOM minimum elements and format guidance                |

## Capabilities and taxonomies

| Reference                                                | Topic                                                       |
|----------------------------------------------------------|-------------------------------------------------------------|
| [capabilities-inventory.md](capabilities-inventory.md)   | 27 combined capabilities across hve-core, PAT, and shared   |
| [adoption-categories.md](adoption-categories.md)         | Six adoption categories, effort sizing, and concern levels  |
| [scorecard-check-mapping.md](scorecard-check-mapping.md) | Full 20-check implementation and adoption reference mapping |
| [priority-derivation.md](priority-derivation.md)         | Risk level to priority and execution order derivation       |

## Consolidated attribution

OpenSSF Scorecard check data derives from the OpenSSF Scorecard project, licensed under Apache 2.0. Source: <https://github.com/ossf/scorecard>

SLSA Build Track level data derives from the SLSA specification, licensed under Community Specification License 1.0. Source: <https://slsa.dev/spec/>

OpenSSF Best Practices Badge criteria derive from the CII Best Practices Badge project, licensed under MIT (criteria) and CC BY 3.0+ (documentation). Source: <https://www.bestpractices.dev/>

Sigstore maturity data derives from the Sigstore project, licensed under Apache 2.0. Source: <https://www.sigstore.dev/>

SPDX content derives from the SPDX specification, licensed under Community Specification License 1.0. Source: <https://spdx.dev/>

CycloneDX content derives from the CycloneDX specification, licensed under Apache 2.0. Source: <https://cyclonedx.org/>

NTIA Minimum Elements content derives from a U.S. government publication. Not subject to copyright (17 U.S.C. section 105).

OpenSSF is a registered trademark of the Linux Foundation.

> Brought to you by microsoft/hve-core
