What's supported by Harness SCS

The SCS module supports these components and standards.

This document outlines the platforms, features, and integrations supported by Harness SCS. The Supply Chain Security (SCS) module is available on the following platforms:

SCS on Harness SaaS

Repository Security Posture Management - RSPM.
Generate or ingest SBOM, followed by SBOM drift detection and scoring.
Enforce OSS usage with SBOM governance policies.
Generate SLSA provenance and achieve Build Levels 1, 2, and 3.
Verify SLSA provenance with SLSA governance policies.
Attest and verify SBOM and SLSA Provenance with Cosign.
Create and manage Remediation Trackers.

SCS on Harness Self-Managed Enterprise Edition (SMP)

Connected Environment

All features of 'SCS on Harness SaaS' are available in an SMP environment, with the following exceptions:

Creating a Remediation tracker will require manually adding the CVE details as auto-population is linked with STO module. However, if you are using Harness STO SMP, this limitation does not apply.
Achieving SLSA Level 3 compliance is not possible in SMP, as it requires Harness hosted build infrastructure. This capability is available through 'SCS on Harness SaaS'.

Air-gapped Environment

All features of SCS on Harness SaaS are available in an air-gapped or offline environment, with the following exceptions:

Repository Security Posture Management is not supported in air-gapped environments.
In the generated SBOMs, the license data for certain dependencies will be marked as "NOASSERTION", leading to a reduced SBOM quality score. However, this does not impact the SBOM generation or any other features of SBOM Orchestration.
Logging the attestation record in the Sigstore public Rekor will not be performed during the SBOM and SLSA Provenance attestation process, but this will not impact the attestation itself.
Creating a Remediation tracker will require manually adding the CVE details as auto-population is linked with STO module. However, if you are using Harness STO SMP, this limitation does not apply.
Achieving SLSA Level 3 compliance is not possible in SMP, as it requires Harness hosted build infrastructure. This capability is available through 'SCS on Harness SaaS'.
Detection of Outdated, Unmaintained, Close to EOL, and EOL Components is not yet supported.

SCS Steps Support Across Stages

Step

Build Stage

Security Stage

Deploy Stage

SBOM Orchestration

Yes

SBOM Policy Enforcement

Yes

SLSA Generation

Yes

SLSA Verification

Yes

SCS Compliance

Yes

Artifact Signing

Yes

Artifact Verification

Yes

You can view deployments in the Remediation Tracker and the Chain of Custody only for Kubernetes, Amazon ECS, and Helm deployment types. Support for other CD deployment types will be added in the future.