Transitive Depth

Flags components with transitive dependencies exceeding 8 levels: expanded attack surface.


Short name	Trans. Depth
Region	Internal
Country or scope	Internal
Sector	Supply Chain
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers Trans. Depth

Scan requirements: 4, all decided by a scan.
Controls: the scan requirements below, plus 7 controls from Safeguard's control catalog for Trans. Depth.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for Trans. Depth and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 4 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`TRANS-1` Dependency Relationship Completeness	All components should have dependency relationships	Scan
`TRANS-2` Transitive Dependency Count	High transitive counts increase attack surface	Scan
`TRANS-3` Circular Dependency Detection	Circular dependencies indicate architectural issues	Scan
`TRANS-4` PURL Coverage for Resolution	Components need PURL for transitive dependency resolution	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`TD-01`	Maximum Transitive Depth Threshold
`TD-02`	Surface-Area Metric Tracking
`TD-03`	Flattening Strategy Documentation
`TD-04`	Dependency Graph Health Score
`TD-05`	Critical-Path Transitive Vulnerability Risk
`TD-06`	Ghost Dependency Detection
`TD-07`	Lock-File Consistency

Policy templates

Written for Trans. Depth:

Transitive Dependency Risk Management Policy
Critical-Path Reachability and Ghost Dependency Policy
Dependency Graph Health Reporting and Accountability Policy

And 22 from the standard set, adapted to Trans. Depth.