As the Department of the Air Force accelerates software delivery through DevSecOps, cloud-native architectures, and software-defined mission systems, understanding the software supply chain has become more critical than ever to effective cyber risk management. Modern capabilities across the Department's evolving kill web increasingly rely on containerized software, open-source components, and complex dependency chains that challenge traditional compliance-centric authorization processes. Platform One’s Iron Bank plays a unique role in the Department of Defense as the software security-supply chain arbitrator, especially for Open-Source software. When up to 98% of code bases* rely on Open-Source Software components, it is crucial to understand how mission system risk can be evaluated.

Traditional compliance-centric authorization processes are outdated the moment they are signed (and likely well before that point). Iron Bank is seeking to provide a presentation on the practical overview of the modern software supply chain and its role in Authority to Operate (ATO) and Certificate to Field (CtF) decisions. Attendees will gain an understanding of how container images, Software Bills of Materials (SBOMs), Common Vulnerabilities and Exposures (CVEs), vulnerability scanners, attestations, and supply chain frameworks contribute to assessing software risk, esp. for mission systems.

The session will examine the limitations of treating compliance artifacts as proxies for security and demonstrate how software supply chain telemetry can enable automated, data-centric risk decisions rather than a traditional compliance-centric authorization approach. By improving visibility into the software components that underpin mission systems, organizations can move toward more agile, automated, and assured cybersecurity practices while strengthening trust across the Department's software-enabled mission ecosystem.

*Linux Foundation. A summary of census ii:Open source software application libraries the world depends on. Linux Foundation Blog, 2022.

Submitted by: Lee C. Lambert, AFLCMC/HNCX, Capt, Iron Bank Value Stream Lead