Chapter 32: Lessons from Other Industries¶

Software supply chain security is not a novel challenge. Other industries have spent decades developing sophisticated systems to manage complex supply chains, verify component authenticity, and respond to contamination or counterfeit threats. This chapter examines proven practices from five industries and extracts lessons applicable to software.

The pharmaceutical industry's Drug Supply Chain Security Act (DSCSA) demonstrates how mandatory unique identification, chain of custody documentation, and federated verification infrastructure can achieve comprehensive traceability. Their serialization requirements and phased implementation approach offer a roadmap for software's emerging provenance frameworks like SLSA and Sigstore.

The automotive sector's tiered supplier management model provides a pattern for scaling security requirements through cascading contractual relationships. UN R155/R156 cybersecurity regulations show how mandatory security management systems with market access consequences can drive adoption that voluntary approaches cannot achieve.

Aerospace and defense industries contribute risk-proportionate verification principles through frameworks like DO-178C, which scales assurance intensity based on failure consequences. Their counterfeit parts prevention programs and DFARS flow-down requirements demonstrate how security expectations can propagate through entire supply chains.

The food safety industry's HACCP methodology offers a systematic approach to identifying hazards and establishing critical control points. Their outbreak investigation and traceback capabilities provide models for responding to software supply chain incidents, while FSMA's shift toward preventive controls mirrors security's "shift left" philosophy.

Financial services third-party risk management frameworks represent the most mature models for ongoing supplier oversight, including structured due diligence, concentration risk assessment, and resilience planning. DORA regulations explicitly extend these requirements to ICT dependencies, creating precedents that other sectors will likely follow.

The common thread across all industries is that effective supply chain security requires mandatory requirements, unique identification, traceability infrastructure, proportionate verification, and clear accountability. Software can accelerate its maturation by adapting these proven patterns rather than learning the same lessons through costly incidents.