Traceability and risk management in software supply chain cybersecurity: A systematic literature review and conceptual framework

The framework is designed to record dependencies, build and test results, deployment events, processes and human interactions in an immutable manner, enabling subsequent verification and auditing by any interested party. Its modular design, role assignment, inclusion of operational metrics, and alignment with recognised standards and best practices are intended to support adaptation to organisations with different levels of maturity and resources.

This paper presents a framework that addresses a gap in the literature by providing integrated support for traceability, risk management, and cybersecurity throughout the software supply chain.