T/CQCIO 001-2023 Software Supply Chain Security Technology Detection Specification

Scope

Main technical content: In the digital era, software defines everything, and software has become one of the most fundamental elements supporting the normal operation of society. With the continuous development of the software industry and software engineering, software contains an increasing number of program files and dynamic libraries, and accesses an increasing variety of elements such as IP and URLs. The interdependencies among these elements are becoming more common, and complex supply chains may lead to a series of security issues. Once a problem occurs in any element of the software supply chain, it is likely to directly affect all software in the supply chain. The complexity of the software supply chain is making it increasingly difficult to ensure the overall security of information systems. As early as 2016, the National Internet Information Office issued the "National Cybersecurity Strategy", which proposed to "strengthen the foundation of network security, adhere to innovation-driven development, and make breakthroughs in core technologies as soon as possible. Attach importance to software security and accelerate the promotion and application of safe and trustworthy products", incorporating software security into the tasks of network security strategy and ushering in the era of software supply chain security. Software supply chain security has gradually become a separate security sub-field recognized by society. To further clarify the goals of software supply chain security and guide the healthy and rapid development of the industry, in 2021, the Ministry of Industry and Information Technology issued the "Plan for the Development of the Software and Information Technology Services Industry during the '14th Five-Year Plan' Period", proposing in the section on safeguard measures to "carry out assessments and reviews of software data security and content security, strengthen the ability to detect and manage security vulnerabilities in software source code,

Development Information

Related Standards