Nexus Standards · Trust, Verification and Assurance · Cross-cutting capabilities
Area · listed in the registry (planned)
Sets the evidence a risk software release must carry: SBOMs in SPDX or CycloneDX, SLSA build provenance as in-toto attestations, Sigstore signatures, vulnerability exchange in OSV, CSAF or OpenVEX, and archival with SWHIDs, so that engines feeding warnings or triggers are traceable to source. Each artifact of the area carries a UNI (Unique Nexus Identifier).
Area profile proposed for the Nexus Standards registry.
NXS-STD-DC-000003Nexus Standards (2026). Software and supply chain: area brief, Trust, Verification and Assurance programme. Proposed. https://nexustandards.com/assurance/software-and-supply-chain-standards/ · UNI NXS-STD-DC-000003. Last reviewed 17 October 2026.
Files include the credits and the licence statement and are generated in the browser; no data is transmitted. Downloads require JavaScript.
An area of the Trust, Verification and Assurance programme (cross-cutting capabilities). The area profile sets out 4 matters in scope and 3 matters addressed by other areas.
In scope 4
Out of scope 3
Jurisdictions Application in each jurisdiction is a national decision, taken by the National Standards Council (NSC) with the competent national authorities.
The map frames West Africa as an example geography for software and supply chain; the frame gives context and is not a statement of where the standards apply. Shown at first: night-time lights, daily (VIIRS Black Marble, VNP46A2, NASA LAADS DAAC) and population density, 2020 (Gridded Population of the World v4.11, NASA SEDAC, CIESIN, Columbia University). The layer drawer adds true colour (VIIRS NOAA-20 corrected reflectance). NASA products are served through NASA GIBS under NASA's open data policy, with acknowledgement; population density is GPW v4.11 by CIESIN, Columbia University, under CC BY 4.0; coastlines, boundaries and place names come from NASA GIBS reference layers (© OpenStreetMap contributors, ODbL) and Natural Earth (public domain). Each layer shows its own observation date; full credits are given under the map. Other sources of the profile, such as OSV.dev vulnerability API and NVD CVE API 2.0, are listed for reference.
The interactive map needs JavaScript; the layer list and sources are below.
Layers 2
Connected activity
Keyboard, with the map focused
Hold Ctrl or ⌘ and scroll to zoom
Latest available
NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Blue Marble (NASA) · © OpenStreetMap contributors (ODbL) · Natural Earth
Loading the latest NASA imagery.
Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.
Connected activity, framed on West Africa. Layers as NASA publishes them, each with its own date.Satellite and model products as NASA publishes them, each with its own date; indicators, not assessments of any place.
Layers and dates
A request reaches the service with an explicit context; inputs are identified (NS-1) and validated against SPDX specification; the service processes them and writes records with provenance; results are published, resolved and monitored, and a correction flows back through the same path. Nexus Standards applied: NS-12, NS-11, NS-1. 8 operations in 5 phases, built from the area profile: the cards carry its own data sources, indicators, open standards, couplings and, where listed, hazards, and each operation names the Nexus rules it implements (11). Records and artifacts are cited by UNI (Unique Nexus Identifier) and version.
Request start · Request
The service covers: SBOM content and format (SPDX 3, CycloneDX 1.6) and licence identification with SPDX expressions, Build provenance (SLSA v1.x, in-toto attestations) and keyless or role-key signing (Sigstore) and Vulnerability disclosure and exploitability statements (OSV schema, CSAF 2.0, OpenVEX).
Identify inputs step · Request
Every input is resolved before it is used; an unresolved input is a typed refusal.
Validate SPDX gate · Validation
Open standards of this area: SPDX specification, CycloneDX Bill of Materials (ECMA-424), Supply-chain Levels for Software Artifacts (SLSA) and in-toto Attestation Framework.
Process model · Processing
Processing is reproducible from the inputs, the method version and the configuration.
Write records record · Processing
Results are written append-only; a correction adds a version.
Publish and resolve step · Publication
Results are discoverable and citable by UNI.
Monitor exercise · Monitoring
Data sources the service reads: OSV.dev vulnerability API, NVD CVE API 2.0 and Rekor public transparency log. Data sources are listed for reference; live data is displayed once licence review is complete.
Correction end · Monitoring
Products that used a corrected record are listed and recomputed.
Fig.Phases read left to right; each card names the operation, its actor and the record it leaves, and each edge label names the hand-over. Play, step or scrub; the detail panel gives the full text of the selected operation. Sources: SPDX specification · CycloneDX Bill of Materials (ECMA-424) · NS-12: Software, model and AI/ML artifacts · NS-11: Verification and monitoring.
The standards architecture of this context, from the foundation standards to the open standards referenced (grouped by type of relation) and the services and data sources that build on them.
The interactive view requires JavaScript; the sections below present the same records.
The area profile lists 3 Nexus Standards; the registry lists NS-12 for this area. Each is a proposed standard under development.
Status: proposed · 4 requirements stated. Read NS-12 · Requirements for this area
Status: proposed · 6 requirements stated. Read NS-11 · Requirements for this area
Status: proposed · 10 requirements stated. Read NS-1 · Requirements for this area
A system model of this area built from the registry: 5 systems, 4 sectors, 9 controls, 3 feeds, 2 indicators. Select the components to include, choose an initiating hazard and run the scenario. Stress propagates through the hazard relations of the Nexus Hazard Standard (NHS-1), the exposure of each system, the recorded couplings and the sectors that carry the loss; adopted standards dampen transmission and live data sources support detection. All parameters are stated assumptions that the reader can adjust; results are illustrative scenario outputs for exercises and training, not forecasts or risk assessments.
Systems and couplings
Controls
NS-12 Software, model and AI/ML artifacts (supply chain, model cards, dataset sheets)NS-11 Verification and monitoring (evidence, attestations, zero-trust conformance observation)NS-1 The UNI and the artifact catalog (grammar v0.2: domain, sector, region and environment segments)NRS-T8 Software and supply-chain integrity riskNRS-H60 Hazard family: Supply-chain and flow disruption (NHS-1 sys.supply-chain)NRS-A5 Built-in licensing and rightsNRS-I7 Intelligence applications: grounded retrieval, reasoning and decision supportNRS-C8 Evidence, uncertainty and provenanceNRS-H51 Hazard family: Malicious compromise (NHS-1 cyber.intrusion)Observation
8 open standards, each with its relation as recorded in the register under NS-14. Hover over or focus a relation for its definition.
adopt5
SPDX specificationLinux Foundation (SPDX)listed in the register · spdxCycloneDX Bill of Materials (ECMA-424)OWASP / Ecma Internationallisted in the register · cyclonedxin-toto Attestation Frameworkin-toto (CNCF)listed in the register · in-toto-attestationSigstore (Cosign, Fulcio, Rekor)OpenSSFlisted in the register · sigstoreOpen Source Vulnerability (OSV) schemaOpenSSFproposed for the registerTest suites, conformance statements and attestations for each standard, as recorded in the registry.
PlannedReference deployments and a sandbox with worked examples.
In developmentVersion and source status for each standard, as published by the issuing bodies.
Each console computes from the registry and states its reasoning; decisions remain with the competent bodies.
4 couplings link this area to other areas and programmes, each with the mechanism of the link. Select a card on the diagram to trace a coupling.
Fig.The area at the left; coupled areas in the same programme, coupled areas in other programmes and the programmes reached to the right.
3 data sources named in the area profile, each with provider, licence, update frequency and delivery path.
Data sources are listed for reference; live data is displayed once licence review is complete.
NVD CVE API 2.0for reference
NIST National Vulnerability Database · continuous
U.S. Government work (public domain); NVD terms of use
governed data serviceproposed for the data register
OSV.dev vulnerability APIfor reference
OpenSSF / Google · continuous
Per-source licences aggregated by OSV.dev (many CC BY 4.0 or CC0)
listed for referenceproposed for the data register
Rekor public transparency logfor reference
Sigstore (OpenSSF) · continuous
Public log entries; Sigstore public-good instance terms
listed for referenceproposed for the data register
The area profile names 2 indicators, each with its framework and code.
Indicator names and codes are given as published by their stewards.
Standards whose text is not openly available are named and linked only. Any compatibility profile is kept on protected pages until an arrangement with the issuing body is in place.
The working group may identify restricted standards relevant to this area; they are listed here by name and link.
A proposed charter for this area, open to institutions and experts.
Maintain supply-chain evidence requirements for risk software, models and data pipelines.
Institutions and experts are invited to charter this working group under NS-13 by filing a public change record. National Working Groups (NWGs) contribute national inputs and field exercises through their National Nexus Consortium (NNC).
What each institution of the ecosystem draws from this area: GCRI Canada, as Secretariat, for evidence; The Global Risks Forum (GRF) for recognition; and The Global Risks Alliance (GRA) for capital.
GCRI Canada accepts model and engine outputs as evidence only from releases whose source is archived with a SWHID and whose build provenance verifies.
GRF records a programme's software supply-chain posture as attestations with evaluator and time of evaluation, not as a badge.
GRA treats an unsigned or unprovenanced trigger calculation as an operational risk that must be disclosed in the readiness file.
Each institution determines under its own rules what it accepts as evidence; a pathway reading is neither an approval nor investment advice.
The area profile identifies 4 user communities.
3 questions identified as priorities for the working group.
Hazards and threats 0
This area draws on the hazards of the areas it is coupled with.
Sectors 0
This area serves all sectors through the areas it is coupled with.
This area is listed in the registry (status: planned; scope NXQ; 3 crosswalk domains). It has five depth pages and a register crosswalk of its domains.
The rules of each listed standard, read through the specification reader.
Depth · CrosswalkEvery register entry in the area's domains, by relation, with the crosswalk graph.
Depth · Records and schemasScope, record, schema explorer and how a UNI resolves.
Depth · ConformanceClauses, evidence and attestations for conformance assessment.
Depth · ReadinessThe area alongside the three pathways, as a matrix.
1 Nexus Standards · 3 domains · 33 external standards · 21 issuing bodies · 0 implementing repositories. Relations (adopt, profile, crosswalk, cite) are as recorded in the register; names and standards remain with their stewards.
Crosswalk graph58 nodes and 69 links from the registry of external standards, programme areas and implementations (registry/external-standards.yaml, registry/consumers.yaml. Relations (adopt, profile, crosswalk, cite) are shown as recorded in the register.
Areas carry no geography of their own; the map shows where the bodies that issue the area's external standards are based.
| Body | Seat | Register entries |
|---|---|---|
| NIST | Gaithersburg, Maryland, United States | 8 |
| ISO/IEC JTC 1/SC 27 | Geneva, Switzerland | 4 |
| OASIS Cyber Threat Intelligence TC | Woburn, Massachusetts, United States | 2 |
| OpenSSF | San Francisco, California, United States | 2 |
| FIRST CVSS Special Interest Group | Cary, North Carolina, United States | 1 |
| IETF | Wilmington, Delaware, United States | 1 |
| ISO/TC 292 | Geneva, Switzerland | 1 |
| OASIS CSAF TC | Woburn, Massachusetts, United States | 1 |
| OpenAPI Initiative (Linux Foundation) | San Francisco, California, United States | 1 |
| OpenSSF (Linux Foundation) | San Francisco, California, United States | 1 |
| OpenVEX community (OpenSSF project) | San Francisco, California, United States | 1 |
| OWASP CycloneDX; Ecma International TC54 | Geneva, Switzerland | 1 |
| SPDX project (Linux Foundation); ISO/IEC JTC 1 | San Francisco, California, United States | 1 |
Issuing bodies are shown at the city of their public seat. The 1 programmes, 0 implementing repositories and 19 Nexus Standards have no location and are not mapped · 8 issuing bodies have no single public seat and are listed without a location: CodeMeta project; Citation File Format project; JSON Schema organization; World Customs Organization; International Atomic Energy Agency; United Nations General Assembly; and others
Standards globe13 issuing bodies with a public seat and 33 register entries, shown on H3 cells at resolutions 1 to 4. Seats are placed at city coordinates; programme areas, implementations and standards have no location and are not drawn. A static plate carrée map is shown where scripts are unavailable.
4 references from peer-reviewed and official publications cited in the area profile, linked at the publishers' own sites.
Recent peer-reviewed articles, preprints, datasets and reports on the subject of this area, retrieved at the time of reading from open scholarly metadata services (OpenAlex, Crossref, DataCite, Zenodo, arXiv, Europe PMC, OpenAIRE Graph) with search terms composed from the registry. Each work is listed with its authors, venue, year, type, open-access status and licence, and links to its DOI or landing page. Sources not yet enabled for live display on this site are listed for reference and are not queried.
Search termssoftware supply chain; software bill of materials; open source software security; SPDX specification; CycloneDX Bill of MaterialsDerived from the title and scope of the area, the NHS-1 hazards it names and the open standards it lists.
No source is enabled for live display on this site yet: the sources are listed for reference and none is queried. Once the publisher of record enables a source after its terms are reviewed, recent works are listed here. Metadata and links only: title, authors, venue, year, type, open-access status and licence as each source records them; works are listed for orientation, not reviewed or endorsed.
2 courses and 3 disciplines of Risk Academy (risksacademy.com) that teach the knowledge and methods of this area. Each course lists its level, stream and learning hours.
The correspondence between courses, disciplines and the Nexus Standards is maintained with Risk Academy and is subject to its academic review.
GCRI Canada, The Global Risks Forum (GRF), The Global Risks Alliance (GRA) and Risk Academy work on the subject of this area in distinct roles (research and evidence; governance, policy and convening; capital, finance and markets; education and training). Each entry states why it corresponds and the step it offers; each institution sets its own terms of participation.
Research and evidence
GCRI Canada
Research programmes that produce the observations, models and assessments these records describe.
Cybersecurity and Digital ResilienceStudies software supply-chain security.Apply to this programme therisk.globalAll programmes of GCRI CanadaGovernance, policy and convening
The Global Risks Forum (GRF)
Tracks that convene public authorities, researchers and institutions on the governance of shared risks.
AI and Digital GovernanceExamines technology procurement and standards.Join this track globalriskforum.comAll tracks of The Global Risks ForumCapital, finance and markets
The Global Risks Alliance (GRA)
Industry programmes in which financial institutions build a shared understanding of systemic risk.
Financial Cyber and Operational ResilienceWorks on digital supply chains in financial services.Join this programme globalriskalliance.comAll programmes of The Global Risks AllianceEducation and training
Risk Academy
Courses and disciplines that teach the knowledge and methods practitioners need to apply these standards.
Technology and DataRAT-204 · Intermediate · 19 learning hoursManaging risk data, AI, digital infrastructure and technology risk responsiblyTake this course Clausecraft and LicensingRAT-202 · Intermediate · 20 learning hoursLicences, attribution, data-sharing agreements and risk-transfer clauses for risk tools, at a methods levelTake this course All courses and disciplinesListed in the education and training section of this pagePeer-reviewed articles, preprints, reports and datasets on the subject of this area, retrieved at the time of reading from open scholarly metadata services (OpenAlex and Crossref) and listed with authors, venue, year, type and access status, with a link to each work. Curated references and related standards are listed first; recent works matched by subject follow and are listed for orientation.
Search terms, derived from the title and scope of the area: software supply chain; software bill of materials; open source software security. With JavaScript enabled, recent works matching these terms are listed from OpenAlex and Crossref.
Nexus Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Institutions and experts are invited to propose amendments, join the working group or propose data sources. National participation is organised through each country's National Nexus Consortium (NNC) and its National Working Groups (NWGs); competent national authorities are engaged through official channels.
Status and use. The Nexus Standards are proposed standards developed through an open process under NS-13 and published for voluntary use; they do not constitute certification, accreditation or regulatory approval, and adoption remains a decision of the Global Standards Council and, in each country, of its National Standards Council. A UNI (Unique Nexus Identifier) identifies an artifact; it does not certify it. Names of standards bodies and their standards belong to their stewards and are used only to identify the documents; no text of an external standard is reproduced here. Nexus Standards is not affiliated with, endorsed by or certified by any standards body named here.
Licences: CC BY 4.0 for standards text, registries, schemas and data; Apache-2.0 for reference code. External standards are cited by name, number and link under their own licences. Third-party data, libraries and fonts keep their own licences: see Third-party notices.