Software Supply Chain Risk Management: From Products to Systems of Systems
Supply chains are usually thought of as manufacturing and delivering physical items, but there are also supply chains associated with the development and operation of a software system. Software supply chain research does not have decades of evidence to draw on, as with physical-item supply chains. Taking a systems perspective on software supply chain risks, this report considers current practices in software supply chain analysis and suggests some foundational practices. The product and supplier selection criteria for system development depend on how a product is used in a system. While many of the criteria for the selection of product suppliers and system development contractors are the same, there is also a significant difference between these kinds of acquisitions. Product development is completed in advance of an acquirer's product and supplier assessment. There is no guarantee that current supplier development practices were used for a specific product. For custom system acquisitions, acquirers can and should actively monitor both contractor and product supply chain risks during development. This report suggests contractor and acquirer activities that support the management of supply chain risks.
This report is related to the following area(s) of work:
Security and SurvivabilityTechnical Note
CMU/SEI-2010-TN-026
December 2010
Cite This Report
SEI:
Ellison, Robert; Alberts, Christopher; Creel, Rita; Dorofee, Audrey; & Woody, Carol. Software Supply Chain Risk Management: From Products to Systems of Systems (CMU/SEI-2010-TN-026). Software Engineering Institute, Carnegie Mellon University, 2010. http://www.sei.cmu.edu/library/abstracts/reports/10tn026.cfm
IEEE:
R. Ellison, C. Alberts, R. Creel, A. Dorofee, and C. Woody, "Software Supply Chain Risk Management: From Products to Systems of Systems," Software Engineering Institute, Carnegie Mellon University, Pittsburgh, Pennsylvania, Technical Note CMU/SEI-2010-TN-026, 2010. http://www.sei.cmu.edu/library/abstracts/reports/10tn026.cfm
APA:
Ellison, R., Alberts, C., Creel, R., Dorofee, A., & Woody, C. (2010). Software Supply Chain Risk Management: From Products to Systems of Systems (CMU/SEI-2010-TN-026). Retrieved May 19, 2013, from the Software Engineering Institute, Carnegie Mellon University website: http://www.sei.cmu.edu/library/abstracts/reports/10tn026.cfm
CHI:
Ellison, Robert, Christopher Alberts, Rita Creel, Audrey Dorofee, and Carol Woody. Software Supply Chain Risk Management: From Products to Systems of Systems (CMU/SEI-2010-TN-026). Pittsburgh, PA: Software Engineering Institute, Carnegie Mellon University, 2010. http://www.sei.cmu.edu/library/abstracts/reports/10tn026.cfm
MLA:
Ellison, R., Alberts, C., Creel, R., Dorofee, A., & Woody, C. 2010. Software Supply Chain Risk Management: From Products to Systems of Systems (Technical Report CMU/SEI-2010-TN-026). Pittsburgh: Software Engineering Institute, Carnegie Mellon University. http://www.sei.cmu.edu/library/abstracts/reports/10tn026.cfm
Find Us Here
Share This Page
For more information
