Engineering can back up supply chain claims with seven kinds of evidence: a dated component inventory, a findings report, decisions with reasons, fix timelines, build records, policy settings and a supplier list. Ask for these in a form you can read, with dates and owners attached.
Why evidence beats assurance
"We take supply chain seriously" cannot be checked. A dated inventory can. Customers and auditors increasingly ask for the second kind. CISA's attestation form page, for instance, describes a self attestation based on NIST's SSDF, which means the producer states the practices it follows. Having evidence ready makes such statements easier to stand behind.
The seven items
| Evidence | What it shows | What to check |
|---|---|---|
| Component inventory | What ships | Date, product and version covered |
| Findings report | Known flaws found | Date, scope, severity and exploitation notes |
| Decision log | Why items were fixed or accepted | Reason, owner, date |
| Fix timeline | How fast serious issues close | Announcement date to deployed fix |
| Build records | How the product was produced | Who ran it, what source it used |
| Policy settings | What is blocked or allowed | Current rules and exceptions |
| Supplier list | Who you depend on | Owner and review date |
Red flags
- Evidence with no date
- Screenshots instead of records you can export
- Decisions with no named owner
- Policies with long lists of unexplained exceptions
Making it routine
Collect the same items on a set schedule so you are not scrambling when a request arrives. A shared folder or system that stores them automatically saves hours. Agree who can release evidence outside the company.
What not to claim
Evidence supports specific statements. Do not stretch it into claims it does not cover, such as an audit result you have not received. Say exactly what the evidence shows and the date it covers.
Where Safeguard fits
Safeguard offers compliance and evidence automation, SBOM and dependency scanning, and policies and gates for pull requests. You can run a free scan on a repository.
Try it yourself
Look at how findings and controls map to a framework and picture which of the seven evidence items would back each line.
Click through it at your own pace, or open it full screen.
Quick check
Who should own evidence collection?
Usually security or compliance, with engineering supplying the source data and a named reviewer signing off.
How long should we keep it?
Ask legal and your auditors. Retention depends on contracts and obligations.
Sources
- CISA, Secure Software Development Attestation Form
- NIST SP 800-218, Secure Software Development Framework
Last reviewed: 19 October 2026.
