Technology Supply-Chain Integrity Across the Systems Development Lifecycle (SDLC)

Defines Technology Supply-Chain Integrity as lifecycle governance of supplier, component, Service, tool, data, Model, provenance, integrity, support, and exit dependencies.

Governing Principle

Identify, assess, contract for, verify, monitor, and govern all material direct and transitive technology dependencies throughout the SDLC.

Required Lifecycle Treatment

Application Through the SDLC

Apply this discipline continuously from Intake through Retirement, translating the governing principle into testable requirements during Design and Build, generating decision-ready evidence through integration and acceptance testing, verifying the authorized state in Production and Operations, and closing remaining obligations at Retirement.

Governance and Evidence

Establish named ownership — Solution, Release, discipline, evidence, and Risk — proportionate to the work’s actual criticality and reversibility. Keep Risks, exceptions, and Technical Debt visible in authoritative systems, not buried in narrative updates. Generative AI may assist with analysis and drafting, but accountable decisions remain with named human authorities.

Connections to Related IF4IT Practices and Inventories

Use Technology Portfolio Management (TPM) Best Practices and the Software Technologies Inventory and Attributes to select approved technologies, expose standards exceptions, record configuration baselines, and manage supportability and obsolescence.

The Non-Functional Requirements (NFRs) Framework for Software Systems connects quality expectations to validation methods, test evidence, acceptance criteria, readiness gates, and Production assurance.

Security, privacy, Risk, compliance, audit, and authorization controls should be integrated throughout this chapter’s decisions and responsibilities so required evidence, exceptions, residual Risk, and accountable approvals stay visible and governed.