Provenance Chain

Supply chain provenance completeness: creator documentation, integrity hashes, dependency graph.


Short name	Provenance
Region	Internal
Country or scope	Internal
Sector	Supply Chain
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers Provenance

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 7 controls from Safeguard's control catalog for Provenance.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for Provenance and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`PROV-AUTHOR` SBOM Author Recorded	The name of the entity or tool that created the SBOM must be recorded, anchoring the start of the provenance chain (NTIA Minimum Elements: 'Author of SBOM Data'; SPDX creationInfo / CycloneDX metadata.tools)	Scan
`PROV-TIME` Document Identity and Timestamp	The SBOM must carry a unique document identifier and creation timestamp so a specific document instance can be referenced and superseded (NTIA Minimum Elements: 'Timestamp'; SPDX documentNamespace / CycloneDX serialNumber)	Scan
`PROV-SUPPLIER` Component Supplier Names	Each component must name its supplier: the entity that creates, defines, and identifies it, extending provenance beyond the document to its contents (NTIA Minimum Elements, 'Supplier Name')	Scan
`PROV-HASH` Verifiable Artifact Integrity	Components should carry cryptographic hashes so that the artifacts described can be tied back to the exact bits that were shipped (NTIA Minimum Elements: 'Other Unique Identifiers'; SPDX checksums / CycloneDX hashes)	Scan
`PROV-GRAPH` Dependency Relationships	The SBOM must document how components relate to each other so the chain from top-level product to transitive dependency is traceable (NTIA Minimum Elements: 'Dependency Relationship')	Scan
`PROV-ID` Resolvable Component Identity	Provenance claims are only verifiable when components carry standard identifiers (PURL or CPE) that resolve to their upstream sources (NTIA Minimum Elements: 'Other Unique Identifiers')	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`PROV-01`	Creator Documentation
`PROV-02`	Integrity Hash Chain
`PROV-03`	Dependency Graph Completeness
`PROV-04`	Build Attestation (SLSA)
`PROV-05`	Source Repository Linkage
`PROV-06`	SBOM Signing and Non-Repudiation
`PROV-07`	Provenance Retention

Policy templates

Written for Provenance:

Software Provenance and Build Attestation Policy
Provenance Data Retention and Repository Linkage Policy
Dependency Graph Integrity and SBOM Completeness Policy

And 22 from the standard set, adapted to Provenance.