Traceability and risk management in software supply chain cybersecurity: A systematic literature review and conceptual framework

The growing complexity of software development, coupled with substantial reliance on third-party components, has expanded the scope of attacks targeting the software supply chain, compromising the integrity and traceability of software artefacts. This study aims to identify gaps in existing proposals for software supply chain cybersecurity and present a conceptual framework to address the identified shortcomings. A systematic literature review was conducted on traceability and risk management in software supply chain cybersecurity. In total, 29 primary studies were identified and analysed. The review reveals that current proposals address the software supply chain only partially. Based on this analysis, an agile conceptual framework is proposed to provide comprehensive support throughout the software supply chain. The framework is designed to record dependencies, build and test results, deployment events, processes and human interactions in an immutable manner, enabling subsequent verification and auditing by any interested party. Its modular design, role assignment, inclusion of operational metrics, and alignment with recognised standards and best practices are intended to support adaptation to organisations with different levels of maturity and resources. This paper presents a framework that addresses a gap in the literature by providing integrated support for traceability, risk management, and cybersecurity throughout the software supply chain.与日俱增的软件开发复杂度，加之对第三方组件的重度依赖，使得针对软件供应链的攻击范围持续扩大，损害了软件制品（software artefacts）的完整性与可追溯性。本研究旨在梳理现有软件供应链网络安全相关方案的不足，并提出针对性概念框架以弥补前述缺陷。本研究针对软件供应链网络安全领域的可追溯性与风险管理开展系统性文献综述，共纳入并分析了29项原始研究。综述结果显示，现有方案仅能对软件供应链提供部分覆盖。基于上述分析，本研究提出一款敏捷型概念框架，以实现对软件供应链全流程的全方位支撑。该框架旨在以不可篡改的方式记录依赖关系、构建与测试结果、部署事件、流程及人员交互信息，便于后续任意相关方开展验证与审计工作。其模块化设计、角色分配机制、运营指标纳入设计，以及与公认标准和行业最佳实践的适配性，可支持不同成熟度与资源水平的组织完成适配部署。本研究提出的框架填补了现有文献的空白，实现了软件供应链全流程中可追溯性、风险管理与网络安全的一体化支撑。