OSIM: Open Supply-Chain Information Modeling
Already a member?
Access the OSIM community workspace here
Defining information models for exchanging software supply chain data.
The OSIM TC aims to standardize and promote information models for supply chains, addressing the growing threat of cybersecurity breaches. The goal of the OSIM TC is to bring clarity to supply chain partners and eliminate the inefficiencies which come from the increase of disparate implementations. Standard information models will make it easier for companies to plan for upgrades and contingencies and help reduce vulnerabilities, disruptions, and security risks.
An Information Model (IM) defines the essential content of messages used in computing, independently of how those messages are represented (i.e., serialized) for communication or storage. Information models are a means to understand and document the essential information content relevant to a system, application, or protocol exchange without regard to how that information is represented in actual implementations. Having a clear view of the information required provides clarity regarding the goals that the eventual implementation must satisfy.
OSIM Sponsors
TC Leadership
Chairs:
Isaac Hepworth, Google
Jay White, Microsoft
Secretary:
Duncan Sparrell, sFractal Consulting
“OSIM represents an important effort to address the need for greater structure and comprehensibility of software supply chains. By establishing standardized information models we can enhance transparency, interoperability, and resilience in end-to-end operations — ultimately aiding cyber risk management and protecting critical infrastructure.”
Isaac Hepworth
Google, OSIM co-chair
“OSIM’s approach not only drives a universal taxonomy of thought, it also brings clarity and ease to how we implement standards and frameworks to support multiple industry software supply chain security needs. OSIM facilitates the identification of similarities and differences across specifications, enhancing interoperability and simplifying processes. The current cybersecurity landscape can no longer be defended in a silo.”
Jay White
Microsoft, OSIM co-chair
“Checkmarx is proud to be working with OASIS and be part of the OSIM Technical Committee. A major part of Checkmarx’ mission to secure the applications driving our world involves sharing our time, experience, and threat intelligence to help make the software supply chain ecosystem safer. As one of the biggest challenges remains education and closing the knowledge gap, we believe standardization is a crucial step and are committed to assisting in laying the foundations.”
Erez Yalon
VP of Security Research, Checkmarx
“The OASIS OSIM is a vital project for enhancing security and trust in the software supply chain. As a part of the OSIM Technical Committee, Root is committed to advancing supply chain security and transparency, aligning perfectly with this initiative’s goals. By collaborating on data schemas, data modeling, and security standards, we aim to improve vulnerability management and software security, ensuring threats are identified and mitigated promptly. This enhances software integrity, benefiting our customers and strengthening trust in the broader digital ecosystem.”
Ian Riopel
CEO, Root.io
“Having a unified information model for representation of objects in the supply chain domain would enable efficient integration models and interoperability. Especially with the wave for generative AI, such aligned models can bring benefits in development efficiency , reduced maintenance and operations for upcoming innovations in the domain.”
Gururaj Raman
Chief Development Expert, SAP SE
“The goal of OSIM isn’t to create yet another competing standard but to provide a unifying framework. By standardizing OSIM we can bridge the gap between existing data models emphasizing interoperability and collaboration among multiple standards.”
Duncan Sparrell
sFractal Consulting
Frequently Asked Questions
Supply chain cybersecurity is increasingly critical due to rising cybercrime rates and associated costs. The software supply chain plays a pivotal role in cybersecurity, with recent high-profile attacks highlighting vulnerabilities.
Defining OSIM standardized information models in the software and hardware industries will benefit various stakeholders:
· Software and hardware vendors will find clarity in supply chains, aiding in product planning and improving customer satisfaction.
· Open-source maintainers will make informed decisions about project components.
· End users and enterprises will receive timely product information, reducing vulnerabilities and disruptions.
· Technology consultants and service providers will offer better support with standardized information.
· Supply chain partners will experience enhanced transparency and predictability, reducing uncertainties and risks.
· Government agencies will find it easier to oversee the industry and promote fair practices.
While existing data models like CSAF, CycloneDX, SPDX, and OpenVEX focus on specific implementations, OSIM provides a higher-level framework that encompasses these models. OSIM aims to identify commonalities and differences between data models, making it easier to understand and reconcile variations. By standardizing information at a higher level, OSIM facilitates interoperability and collaboration across diverse systems and stakeholders.
Customers receive information from various vendors, each using different standards and terminology. This diversity often leads to confusion and necessitates the integration of additional fields or adjustments to align with these varying formats. Even when using similar products, the terminology can differ significantly, which complicates the understanding and interoperability among systems. Without a unified guidance and framework, vendors might continue creating their unique solutions, further fragmenting the landscape. Hence, there is a significant need for better collaboration and a standardized framework to ensure all parties are aligned and can efficiently interact. The implementation of OSIM could serve as this central framework, offering a standardized approach that would help harmonize how information is exchanged across different systems, reducing confusion and enhancing interoperability.
The OSIM TC’s mailing list archive, used by members to conduct Committee work, is available here. TC membership is required to post to this list. TC members are automatically subscribed.
New Members Welcome
Whether you want to actively contribute in decision-making or just observe progress from the inside, you will need to be an OASIS member.
If your employer is already on our current member list, submit this request form to be added to the TC Roster. If not, find out how to join OASIS.
Non-members may monitor the mailing list archives online, view approved documents, and provide feedback to our comments list. Contact Us for more information.