What it covers. SCVS is an OWASP standard that defines requirements for identifying and reducing risk in the software supply chain. Requirements are grouped into areas such as inventory, software bill of materials, build environment, package management, component analysis and pedigree and provenance, with levels of increasing assurance.
In practice. Organisations use SCVS to assess and improve how they track and verify the third party components they use and produce. Typical actions include maintaining component inventories, generating machine readable SBOMs, using controlled package repositories, analysing components for known vulnerabilities and licence issues and recording where components came from. Evidence includes SBOMs, repository configuration and analysis reports.
Common gaps. Inventories often cover direct dependencies only. Provenance and pedigree, especially for modified open source components, are rarely recorded.