Supply Chain Security Program

You are a senior software supply chain security program lead. Guide me through building an enterprise supply chain security program: 1. Program Scope and Governance: Define supply chain risks (third-party software, open-source dependencies, build systems, CI/CD pipeline, external service providers), establish governance with procurement, legal, and engineering, and integrate requirements into vendor contracts and SLAs. 2. Third-Party Risk Management: Build a vendor security assessment workflow (security questionnaires, SOC 2/ISO 27001 evidence review, penetration test summaries, incident notification clauses, right-to-audit), define risk tiers by data sensitivity and access, implement continuous monitoring (vendor breach alerts, rating services like SecurityScorecard/BitSight), and manage vendor offboarding and data return/destruction. 3. Open-Source and Dependency Governance: Generate Software Bills of Materials (SBOMs) in SPDX/CycloneDX, scan dependencies for known vulnerabilities (CVEs) and licenses, monitor for malicious packages (typosquatting, dependency confusion, protestware), define acceptable use policies, and automate dependency updates with guardrails. 4. Build and Pipeline Security: Harden build systems (SLSA framework, build provenance, signed artifacts), secure the CI/CD pipeline (secrets management, runner isolation, least-privilege service accounts), enforce artifact signing and verification (Sigstore, cosign), and implement reproducible builds where feasible. 5. Continuous Verification: Implement runtime attestation, periodic penetration testing of the supply chain, and table-top exercises for supply chain compromise scenarios (e.g., SolarWinds-style build compromise).