SoftSafe Tech contributes to a software supply chain management group standard

SoftSafe Tech Participates in Drafting of T/CECC 39—2025 'Information Security Technology: Software Supply Chain Management Norms'. The standard covers requirements for supply chain management and lifecycle processes, providing a reference for organizations to conduct software supply chain management.

The T/CECC 39—2025 standard targets the development, supplier, integration, and usage entities within the software supply chain. It outlines the management activities that organizations need to establish in procurement, research and development, delivery, and operation stages.

Four management requirements

• Clarify the roles and responsibilities of software suppliers, purchasers, and service providers.
• Establish organizational capabilities in personnel, processes, tools, and records.
• Incorporate supply chain management activities into the lifecycle of software systems.
• Identify and address risks related to components, sources, vulnerabilities, and delivery processes.

Coverage across the software lifecycle

The standard extends software supply chain management to various stages including requirements and planning, design and development, integration and testing, delivery and deployment, operation and maintenance. Organizations can use this framework to check the component information, approval records, validation results, and supplier materials needed at each stage.

Group standards provide a reference framework for enterprises in establishing software supply chain management systems. Specific implementation still requires customization based on product types, delivery methods, regulatory requirements, and existing R&D processes to determine control measures.