Supply chain governance can be described in four stages: ad hoc, defined, managed and measured. Each stage has recognizable signs. The model below is our own simple self-assessment, not a NIST or industry standard, and it is meant to start a conversation, not to award a score.
The four stages
| Stage | What it looks like | Typical gap |
|---|---|---|
| 1. Ad hoc | Decisions happen in chat. No owner. Exceptions live in people's heads | Nobody can say who may accept a risk |
| 2. Defined | Policy and charter exist. Owner named. Exception form exists | Rules exist but are not enforced consistently |
| 3. Managed | Rules run in the pipeline. Exceptions expire. Reviews happen on a calendar | Little data on whether it reduces risk |
| 4. Measured | Metrics trend over time, definitions are stable, decisions use data, policy changes follow evidence | Keeping it lean as the organization grows |
Signs to check at each stage
Moving from 1 to 2. Can you name the accountable executive? Is there a one page policy? Is there a request form for exceptions? If you answered no to any of these, start there. See what goes in a supply chain security charter.
Moving from 2 to 3. Does the pipeline enforce at least three rules without a human? Do exceptions have end dates and owners? Does a calendar exist for reviews? This stage is mostly about turning paper into automation.
Moving from 3 to 4. Do you track a small set of measures with fixed definitions? Do leaders see trends quarterly? Do you change policy because of what the data shows? See security metrics for your team versus the board.
How to use the model
- Have three people from different functions, such as engineering, security and procurement, score the organization independently.
- Compare answers. The disagreement is more informative than the score.
- Pick one improvement per quarter.
- Re-assess in six months.
Cautions
- Stages are not levels to chase. A small company may be well served by stage 2 or 3 and that can be right for its risk.
- Different areas can sit at different stages. Your open source intake may be stage 3 while supplier contracts are stage 1.
- Maturity models can be gamed. Evidence beats opinion: ask to see the register, the log and the pipeline config.
- Do not present a stage as a certification. It is an internal tool.
For a related longer treatment see SBOM maturity model for enterprises.
Try it yourself
Click through it at your own pace, or open it full screen. Ask which stage the workflow you see assumes: do owners, deadlines and tracking already exist?
Safeguard's policies and gates, continuous scanning and compliance evidence automation are aimed at the step from defined to managed, where rules run by themselves and leave records.
Quick check
Is stage 4 the goal for everyone?
No. Choose the stage that fits your risk and size.
Is this an official model?
No. It is a simple self-assessment written for this post.
Last reviewed: 19 October 2026.
