Fortifying the Software Supply Chain Using ISO 22373 and the MITRE System of Trust (W02c)
This talk explores the integration of ISO 22373’s framework for supply- and value-chain trustworthiness with the MITRE System of Trust to enhance software supply chain security. It will demonstrate how ISO 22373’s emphasis on stakeholder trustworthiness, including security posture, combined with MITRE’s structured assessment of entity trustworthiness, provides a robust methodology. This synergy enables organizations to quantify and manage risk objectively, moving beyond subjective trust to data-driven risk profiling for critical software components and their origins.