Supply-chain Levels for Software Artifacts (SLSA) is a robust security framework aimed at strengthening and maintaining the integrity of software packages throughout their supply chains. A joint initiative led by Google, OpenSSF, and other stakeholders, SLSA provides a standardized checklist of security controls and best practices to defend against cyberattacks on the software supply chain. Its core function is to help developers determine whether the code they rely on has been tampered with and to evaluate the trustworthiness of source code used in software packages. Designed for wide adoption, SLSA encourages verifiable metadata creation and simplifies policy implementation through tiered security levels.

SLSA Levels

SLSA is divided into four progressive levels, each offering a higher degree of security assurance.

• Level 1: Documenting Build Process – This foundational level requires developers to document build environments, processes, source, and dependency metadata, enabling end-users to verify the software's origin and spot potential security gaps.
• Level 2: Tamper-Resistant Build Process – At this level, version control and hosted build services are mandatory. The goal is to establish tamper resistance and authenticate the provenance of software artifacts.
• Level 3: Additional Protection Against Cyberthreats – Security controls are introduced to ensure source and build platforms are trustworthy. This level focuses on auditability and resilience against specific threats.
• Level 4: High Trust and Confidence – The most secure level demands hermetic and reproducible builds. All code changes must be reviewed by at least two certified reviewers to ensure ultimate integrity.

Why is SLSA Important for Organizations?

In today’s complex software supply chain environment, vulnerabilities in third-party components or compromised build systems pose serious threats. SLSA helps mitigate such risks by offering a structured, industry-accepted approach. It acts as a roadmap to security maturity, guiding organizations from basic documentation to complete, verifiable trust in their software artifacts. The framework also supports incident response, promotes best practices, and enhances transparency through detailed provenance. By verifying third-party components and emphasizing continual improvement, SLSA makes it easier for organizations to meet security and compliance needs.

SLSA Use Cases

SLSA is widely applicable across different sectors and development models:

• Securing Open Source Software – Organizations relying on open-source components use SLSA to protect against tampering and ensure component integrity.
• Securing SaaS Vendors – SaaS providers use SLSA to maintain the security and trust of their software, often as part of customer compliance requirements.
• Securing Native Software – For cloud-native environments, SLSA helps safeguard microservices, APIs, and containerized applications.
• Securing CI/CD Pipelines – With automated software delivery becoming standard, SLSA (especially Level 2) helps document provenance and ensure verified artifacts move into production, protecting sensitive data and meeting compliance regulations.

Drawbacks in the SLSA Framework

Despite its benefits, SLSA has a few limitations. Implementing Levels 3 and 4 can be complex and resource-intensive, especially for smaller organizations. The framework focuses heavily on the build and provenance stages, often leaving out aspects like vulnerability management and runtime protection. Moreover, SLSA doesn’t provide complete visibility into all external dependencies and may not fully meet the needs of industries like finance that require tailored security approaches.

Starting an SLSA Program

To begin with SLSA, organizations should aim to meet Level 1 requirements by establishing a CI/CD pipeline or build service. The next step is producing and automating provenance information to track component integrity. Supplying this information to stakeholders helps organizations set a clear security posture and gradually work towards achieving higher levels in the SLSA framework.

Final Words

As software supply chain threats continue to evolve, frameworks like SLSA are becoming essential for organizations aiming to secure their software development lifecycle. While still maturing, SLSA offers a structured, scalable approach to building trust, verifying integrity, and mitigating risks within software artifacts. Its implementation is no longer a luxury—it's a necessity in today’s digital landscape.