# **Digital Supply Chain Audit and Compliance (DSAC) Security Audit Policy V1.0**

Effective Date: 2025-11-15  
Policy Owner: DSAC Governance Committee

## **1\. Purpose and Scope**

This policy establishes the mandatory procedures, responsibilities, and frequencies for auditing all Provenance Records generated by the DSAC system. The primary purpose is to ensure the **integrity, verifiability, and immutability** of the digital supply chain, confirming that all generated artifacts (products) are correctly linked to their inputs (materials) and generating tools.

This policy applies to all systems, tools, and personnel involved in the creation, signing, storage, and auditing of DSAC Provenance Records.

## **2\. Audit Requirements and Frequency**

All Provenance Records **must** undergo two levels of audit: Automated Verification and Human-Led Compliance Review.

### **2.1 Automated Verification (Continuous)**

Automated tools integrated into the DSAC system must perform the following checks upon record generation, signature, and retrieval:

| Requirement | Description | Frequency |
| :---- | :---- | :---- |
| **Schema Compliance** | Verify that the record strictly adheres to the provenance\_schema.json. | **Upon Generation** |
| **Digest Integrity** | Recalculate and verify that the output.digest field matches the hash of the actual artifact. | **Upon Generation** & **Upon Retrieval** |
| **Signature Validation** | Verify the cryptographic signature of the record against the public key of the generator identified in the record. | **Upon Generation** & **Upon Retrieval** |
| **Input Tracing** | Verify that the inputs array contains references (uri and digest) for **all** upstream dependencies. Missing inputs constitute a critical failure. | **Upon Generation** |

### **2.2 Human-Led Compliance Review (Periodic)**

Compliance Officers must conduct periodic, risk-based reviews of automated audit logs and randomly selected Provenance Records.

| Audit Type | Description | Frequency | Responsible Role (Per governance\_roles.md) |
| :---- | :---- | :---- | :---- |
| **High-Risk Artifact Review** | Review Provenance Records for critical production or security artifacts (e.g., core libraries, deployment manifests). | **Quarterly** | Compliance Officer |
| **Tool Configuration Audit** | Review the configuration logs of the generator tools to ensure consistent application of security flags and build parameters (e.g., checking compiler settings). | **Semi-Annually** | Security Architect |
| **Random Record Inspection** | Randomly select 5% of all non-critical Provenance Records to manually verify the inputs and generator fields against internal source control records. | **Annually** | Compliance Officer |

## **3\. Failure Handling and Remediation**

### **3.1 Definition of an Audit Failure**

An Audit Failure occurs when any automated verification or human compliance review identifies a discrepancy, including, but not limited to:

1. **Integrity Failure:** Mismatched cryptographic digests (output.digest does not match the artifact).  
2. **Verifiability Failure:** Invalid or missing cryptographic signatures.  
3. **Compliance Failure:** Provenance Records that deviate from the provenance\_schema.json or fail to list required inputs.

### **3.2 Mandatory Remediation Procedures**

| Severity | Action Required | Responsible Role |
| :---- | :---- | :---- |
| **Critical (Integrity/Verifiability Failure)** | **Immediate action.** The artifact associated with the failed record must be quarantined and cannot be deployed or used. A Decision Log entry must be created immediately, detailing the failure and necessary actions. | Security Architect / Incident Response Team |
| **High (Compliance Failure)** | **Action within 7 days.** The team responsible for generating the record must re-run the build process with correct inputs/schema, generating a new, compliant Provenance Record. | Compliance Officer / Artifact Generator |
| **Low (Documentation/Process Error)** | **Action within 30 days.** Update internal documentation or generator tool configurations to prevent recurrence. | Compliance Officer |

## **4\. Documentation and Reporting**

All Audit Failures, findings, and remediation actions **must** be logged using the official **Decision Log Template** (decision\_log\_template.md).

The Compliance Officer will compile a comprehensive **DSAC Audit Report** on a quarterly basis, summarizing:

* Total number of Provenance Records generated.  
* Total number of Automated Verification Failures (broken down by type).  
* Summary of findings from Human-Led Compliance Reviews.  
* Status of all open remediation tickets.

This report is mandatory reading for the DSAC Governance Committee and the Security Architect.