Nexus Standards · Software and supply chain · Crosswalk

Software and supply chain

Software and supply chain: crosswalk to external standards

The external standards in the crosswalk domains of software and supply chain, from the register, with the relation of each to the Nexus Standards. Each row links to the issuing body, and each relation is evidenced by attestations identified by UNIs (Unique Nexus Identifier).

Back to Software and supply chainAll programme areas
01Canvas

The process.

Crosswalk graph · software and supply chainNexus Standards registry
Software and supply chain: crosswalk58 nodes on four orbits (Nexus Standards and implementing repositories at the centre, then domains, external standards and issuing bodies), joined by 69 recorded relations.
Nexus StandardsDomainsExternal standardsIssuing bodiesImplementing repositories

1 Nexus Standards · 3 domains · 33 external standards · 21 issuing bodies · 0 implementing repositories. Relations (adopt, profile, crosswalk, cite) are as recorded in the register; names and standards remain with their stewards.

Crosswalk graph58 nodes and 69 links from the registry of external standards, programme areas and implementations (registry/external-standards.yaml, registry/consumers.yaml. Relations (adopt, profile, crosswalk, cite) are shown as recorded in the register.

02Software and supply chain integrity

Software and supply chain integrity

10 register entries.

StandardBodyVersionRelationAccessVerified
SPDX (System Package Data Exchange) specification; ISO/IEC 5962:2021SPDX project (Linux Foundation); ISO/IEC JTC 13.0.1 (December 2024); ISO/IEC 5962:2021 published 9 September 2021 covers an earlier 2.x versionadoptopenverified
CycloneDX Bill of Materials specification (ECMA-424)OWASP CycloneDX; Ecma International TC541.6 (9 April 2024; ECMA-424 ratified 26 June 2024); 1.7 and ECMA-424 2nd edition reported by one sourcecrosswalkopenverified
OpenSSF Best Practices BadgeOpenSSFpassing, silver, gold tiersciteopenverified
OpenSSF ScorecardOpenSSFautomated checks scored 0-10citeopenunverified
CodeMeta software metadata vocabularyCodeMeta project3.0 (2023); context lists 3.1 and the repository lists 4.0adoptopenverified
Citation File Format (CITATION.cff)Citation File Format project1.2.0adoptopenunverified
OpenAPI SpecificationOpenAPI Initiative (Linux Foundation)3.1.1 (24 October 2024); 3.1.2 and 3.2.0 dated 19 September 2025 in the repository changelogadoptopenverified
JSON Schema 2020-12JSON Schema organization2020-12 (current per json-schema.org)adoptopenverified
OCI Image Format SpecificationOpen Container Initiative1.1adoptopenunverified
Reproducible Builds definition and practicesReproducible Builds projectcurrentciteopenunverified

Unverified entries rest on a secondary source for at least one field, as indicated in the register.

03Canvas

Crosswalk evidence.

Canvas · crosswalk evidenceProcess diagram
Software and supply chain: how a relation to an external standard is evidencedRegister entries for the area by domain and relation. NS-14 specifies the evidence each relation requires and the form in which a claim may be displayed. Names and standards remain with their stewards.

Fig.Relations recorded for the area and the evidence NS-14 requires before a relation is displayed.

04Earth observation

Electrified and connected activity worldwide

The map is framed on the world as context for software and supply chain. Shown at first: night-time lights, daily (VIIRS Black Marble, VNP46A2, NASA LAADS DAAC) and population density, 2020 (Gridded Population of the World v4.11, NASA SEDAC, CIESIN, Columbia University). The layer drawer adds true colour (VIIRS NOAA-20 corrected reflectance). NASA products are served through NASA GIBS under NASA's open data policy, with acknowledgement; population density is GPW v4.11 by CIESIN, Columbia University, under CC BY 4.0; coastlines, boundaries and place names come from NASA GIBS reference layers (© OpenStreetMap contributors, ODbL) and Natural Earth (public domain). Each layer shows its own observation date; full credits are given under the map. Other sources of the profile, such as OSV.dev vulnerability API and NVD CVE API 2.0, are listed for reference.

The interactive map needs JavaScript; the layer list and sources are below.

Layers 2

Connected activity

Latest available

NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Blue Marble (NASA) · © OpenStreetMap contributors (ODbL) · Natural Earth

Loading the latest NASA imagery.

Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.

Connected activity, framed on World. Layers as NASA publishes them, each with its own date.Satellite and model products as NASA publishes them, each with its own date; indicators, not assessments of any place.

Data: NASA GIBS · ASTER GDEM · Blue Marble · © OpenStreetMap contributors · Natural EarthSources and licences

  • We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS). Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS). Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • VIIRS Black Marble night-time lights, NASA Goddard Space Flight Center; distributed by the NASA Level-1 and Atmosphere Archive and Distribution System (LAADS DAAC); imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • Center for International Earth Science Information Network (CIESIN), Columbia University. 2018. Gridded Population of the World, Version 4 (GPWv4): Population Density, Revision 11. NASA Socioeconomic Data and Applications Center (SEDAC). Licensed under CC BY 4.0. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). doi:10.7927/H49C6VHW. CC BY 4.0
  • VIIRS near-real-time products (flood, land surface temperature, snow cover, corrected reflectance), NASA LANCE; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • ASTER GDEM is a product of METI and NASA (ASTER Global Digital Elevation Model V003, NASA LP DAAC); imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). Cite as: NASA/METI/AIST/Japan Spacesystems and U.S./Japan ASTER Science Team (2019). ASTER Global Digital Elevation Model V003. doi:10.5067/ASTER/ASTGTM.003. NASA open data
  • Made with Natural Earth. Free vector and raster map data @ naturalearthdata.com. Public domain
  • © OpenStreetMap contributors (ODbL), via NASA GIBS (coastlines, boundaries, roads and place names). Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). ODbL
  • Blue Marble, NASA Earth Observatory; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • Context on the globe and flat map: coastlines, boundaries, roads and place names from NASA GIBS reference layers (OpenStreetMap data, ODbL, © OpenStreetMap contributors); Blue Marble imagery as an optional base; 3D terrain and the elevation read-out from the ASTER GDEM elevation colour index (5 m to 200 m classes, exaggerated for legibility). Boundaries are drawn as published and imply no position on any territory.
  • Globe: MapLibre GL JS 6.9.1, BSD-3-Clause, © MapLibre contributors.
  • NASA GIBS: We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS).
  • Optional layers (3 sources in the layer list: live, forecast, observed and context) print their provider credit on the map and here when switched on; forecasts are model output and derived indices are estimates.

Layers and dates

  • Night-time lights, daily: VIIRS Black Marble (VNP46A2), NASA LAADS DAAC · 12 Oct 2026
  • Population density, 2020: Population: CIESIN, Columbia University, Gridded Population of the World v4.11 (2018), NASA SEDAC, CC BY 4.0 · static
  • True colour: VIIRS NOAA-20 corrected reflectance, NASA LANCE · 13 Oct 2026

05Supply chains and logistics

Supply chains and logistics

7 register entries.

StandardBodyVersionRelationAccessVerified
ISO/IEC 27036-2:2022 Cybersecurity - Supplier relationships - Part 2: RequirementsISO/IEC JTC 1/SC 272022 (Part 1 2021, Part 3 2023, Part 4 cloud)citepaywalledverified
NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices for Systems and OrganizationsNISTRev. 1 (May 2022), Update 1 (1 November 2024)citeopenverified
OASIS Common Security Advisory Framework (CSAF) Version 2.0OASIS CSAF TC2.0 (OASIS Standard, November 2022)citeopenverified
OpenVEX specificationOpenVEX community (OpenSSF project)draftciteopenunverified
Supply-chain Levels for Software Artifacts (SLSA)OpenSSF (Linux Foundation)1.1 (April 2025, Approved Specification); site states 1.2 is currentadoptopenverified
ISO 28000:2022 Security and resilience - Security management systemsISO/TC 2922022compatibility profile (restricted)paywalledunverified
WCO SAFE Framework of Standards to Secure and Facilitate Global TradeWorld Customs Organization2021citeopenunverified

Unverified entries rest on a secondary source for at least one field, as indicated in the register.

06Security and cyber

Security and cyber

16 register entries.

StandardBodyVersionRelationAccessVerified
ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection - Information security management systems - RequirementsISO/IEC JTC 1/SC 272022 (edition 3.0, 25 October 2022)compatibility profile (restricted)paywalledverified
ISO/IEC 27005:2022 Guidance on managing information security risksISO/IEC JTC 1/SC 272022 (replaces 2018 edition)citepaywalledverified
ISO/IEC 27701:2025 Privacy information management systemsISO/IEC JTC 1/SC 272025 (standalone edition; 2019 edition was an extension of 27001/27002)citepaywalledverified
NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29)NIST2.0 (26 February 2024)crosswalkopenverified
NIST SP 800-37 Rev. 2 Risk Management Framework for Information Systems and OrganizationsNISTRevision 2citeopenunverified
NIST SP 800-53 Rev. 5 Security and Privacy Controls for Information Systems and OrganizationsNISTRev. 5 (September 2020) with Release 5.2.0 (27 August 2025)crosswalkopenverified
NIST Open Security Controls Assessment Language (OSCAL)NIST1.1.x (1.1.2 confirmed in tooling; 1.1.3 UNVERIFIED)adoptopenverified
OASIS STIX Version 2.1 (Structured Threat Information Expression)OASIS Cyber Threat Intelligence TC2.1 (OASIS Standard, 10 June 2021)citeopenverified
OASIS TAXII Version 2.1 (Trusted Automated Exchange of Intelligence Information)OASIS Cyber Threat Intelligence TC2.1 (OASIS Standard, 10 June 2021)citeopenverified
Common Vulnerability Scoring System v4.0FIRST CVSS Special Interest Group4.0citeopenunverified
FIPS 203 Module-Lattice-Based Key-Encapsulation Mechanism StandardNIST2024adoptopenunverified
FIPS 204 Module-Lattice-Based Digital Signature StandardNIST2024adoptopenunverified
FIPS 205 Stateless Hash-Based Digital Signature StandardNIST2024adoptopenunverified
IAEA Safety Standards (nuclear, radiation, transport and waste safety)International Atomic Energy Agencycurrentciteopenunverified
United Nations Global Counter-Terrorism StrategyUnited Nations General Assemblycurrentciteopenunverified
RFC 8032 Edwards-Curve Digital Signature Algorithm (EdDSA)IETF2017adoptopenunverified

Unverified entries rest on a secondary source for at least one field, as indicated in the register.

07Relations

Relation types and their evidence

RelationMeaningEvidence
citeThe Nexus Standard refers to the external standard as context.Identifier, version and URL in the register.
profileThe Nexus Standard constrains or specialises an open external standard (for example STAC, DCAT, PROV-O, DataCite, CAP).Conformance tests against the external standard's own validator where one exists.
crosswalkElements of the external standard map to Nexus elements (clauses, record fields).A crosswalk table in the register entry; each row cites the external clause by number, never by text.
adoptThe Nexus Standards use the external standard as it is for a function (for example ISO 3166-1, SPDX, ORCID, ROR).Validation of values against the external scheme.
extendA Nexus Standard adds machine-readable, real-time or provenance elements that the external standard lacks.The extension is a Nexus clause or field; the external standard is cited as the baseline.
gapNo external standard covers the concern; a Nexus Standard specifies it.The gap statement in the landscape study.
08Questions

Questions and answers.

Does a crosswalk establish that a software and supply chain artifact conforms to these standards?
A crosswalk is a mapping. A relation is displayed as clauses derived from the external standard and their current results; any determination of conformity with an external standard rests with the body entitled to make it.
Why are some relations shown as compatibility profile (restricted)?
The standard is paywalled. Its text is not reproduced, and a compatibility profile of it is published only under an institutional arrangement with the issuing body.
Why are some entries marked unverified?
An unverified entry rests on a secondary source for at least one of name, body, version or year; NS14-R5 requires it to be shown as unverified.
NRNexus Reports gateway · GW-STD

Contribute to Nexus Reports from this page.

Nexus Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.

Nexus Standards

Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.

Across the Consortium

The same subject across the Consortium.

Related

Around Software and supply chain.

Nexus Standards

Shape the standards for software and supply chain.

Governments, regulators, standards bodies, industry, academia and communities are invited to shape the catalogue ahead of its first official release, targeted for 2030: comment on a draft, propose a change, join a working group or host a field exercise.

Propose a change Roadmap to 2030Adopt and implement

Status and use. The Nexus Standards are proposed standards developed through an open process under NS-13 and published for voluntary use; they do not constitute certification, accreditation or regulatory approval, and adoption remains a decision of the Global Standards Council and, in each country, of its National Standards Council. A UNI (Unique Nexus Identifier) identifies an artifact; it does not certify it. Names of standards bodies and their standards belong to their stewards and are used only to identify the documents; no text of an external standard is reproduced here. Nexus Standards is not affiliated with, endorsed by or certified by any standards body named here.

Licences: CC BY 4.0 for standards text, registries, schemas and data; Apache-2.0 for reference code. External standards are cited by name, number and link under their own licences. Third-party data, libraries and fonts keep their own licences: see Third-party notices.

Skip to toolbar