IT

Where to start

Supply chain security ready for the Cyber Resilience Act

We bring SBOM, artifact signing and DevSecOps into the pipelines you already use. Our management system is ISO/IEC 27001, 27017 and 27018 certified.

Tell us about your project

Security at every step, from the first commit to deploy.

Supply chain security protects the software lifecycle from vulnerabilities, malicious code and compromises, from writing the code to production. SparkFabrik is an AI Native Engineering company that brings these controls into client pipelines and is a member of OpenSSF and Linux Foundation Europe.

The Cyber Resilience Act, the NIS2 directive and the DORA regulation require it too. Our compendium on NIS2 and DORA explains how to bring cloud native applications and the supply chain into line. Our approach is security enablement: controls help developers, they do not stop them.

Results

What changes for your team

  • You know what is in your software

    An SBOM for every build lists components and dependencies: when a vulnerability comes out you know at once whether it affects you.

  • Controls that do not stop releases

    Scans, artifact signing and policies run in the pipelines you already have, from commit to deploy.

  • Compliance you can prove

    Policies, attestations and reports to prove compliance with the Cyber Resilience Act, NIS2 and DORA.

Code, pipelines, policies, platform and containers.

Since 2015 we have brought secure, compliant delivery processes into enterprise organizations. We work inside the development flow you already have.

Security from the first line of code

Source Code Security

SAST and dependency analysis (SCA) in the development flow, from the first commit, with tools such as SonarQube and Snyk.

See also: Web Application
Security integrated into CI/CD flows

Pipeline Security

Automated controls in CI/CD pipelines, on GitLab or GitHub Actions, to catch supply chain threats.

See also: DevOps and Platform Engineering
Automated controls and compliance

Policy Engine & Governance

Security policies with Open Policy Agent (OPA) on build and deploy, artifact signing with Sigstore: auditing, access, compliance.

See also: Kubernetes consulting
Security integrated into Developer Experience

Developer Platform Security

Automated policies, secure templates and verified software catalogs inside the development platform, Backstage included.

See also: Application Modernization
Security for containerized environments

Container Security

Image scanning with Trivy, vulnerability management and container hardening.

See also: Managed Services
Success Stories

Secure pipelines in client projects.

All success stories

  • Kubernetes Certified Service ProviderCloud Native Computing Foundation
  • CNCF
    CNCF memberCloud Native Computing Foundation
  • OpenSSF
    OpenSSF memberOpen Source Security Foundation

Our ISO/IEC certifications.

We apply to ourselves what we recommend: our management system is certified ISO/IEC 27001, 27017 and 27018 for the design and development of software and the management of cloud platforms. Certificates issued by Scandinavian Certification, accredited by Norwegian Accreditation.

The certification covers the company management system, not individual products or services.

Assessment, implementation, governance.

From risk assessment to continuous monitoring.

  1. 01

    Assessment

    Assessment workshops and supply chain risk analysis, with a roadmap of interventions.

  2. 02

    Implementation

    We integrate controls and tools into existing pipelines, one step at a time, without slowing releases down.

  3. 03

    Governance

    Best practices, compliance management, continuous monitoring and reporting.

AI Native Engineering

You know what will be built, and who answers for it.

AI correlates vulnerabilities, context and real exposure; a person on the team decides what to fix first.

Article Continuous vulnerability management with AI for the CRA

The method: AI Native Engineering
Resources

Further reading

Whitepaper · PDF

Cloud Native Security Guide

The challenges, the attacks and the defense strategies.

Download the guide

Frequently asked questions.

About supply chain security.

Do you use AI on our projects? With what guarantees?

Yes. AI correlates vulnerabilities, context and real exposure, so the team sees first what matters; a person decides what to fix and when. The checks live in the pipelines you already use and the rules stay in your repository.

What is an SBOM and why is it important?

An SBOM (Software Bill of Materials) is a complete inventory of all software components and dependencies. It matters because it:

  • lets you find known vulnerabilities quickly (like Log4Shell in Log4j)
  • is required by regulations such as US Executive Order 14028 and the Cyber Resilience Act
  • makes security and compliance audits easier
  • improves transparency toward clients and stakeholders

We generate SBOMs in standard formats (SPDX, CycloneDX) integrated into CI/CD pipelines.

For Drupal sites we use DruBOM, our open source module that generates the SBOM of the site, useful for the Cyber Resilience Act. The steps are in our article on generating the SBOM of a Drupal site with DruBOM.

What does SLSA mean and what levels exist?

SLSA (Supply-chain Levels for Software Artifacts) is an OpenSSF security framework. Since version 1.0 its levels are grouped in tracks. The Build track has four levels:

  • Build L0: no requirements
  • Build L1: provenance showing how the package was built
  • Build L2: signed provenance, generated by a hosted build platform
  • Build L3: hardened build platform, preventing tampering during the build

Version 1.2 adds the Source track, with levels from Source L1 to Source L4 for source code.

We help companies achieve increasing SLSA levels based on their security needs.

Who provides Supply Chain Security services in Europe?

SparkFabrik is a member of the Open Source Security Foundation (OpenSSF), and its management system is certified ISO/IEC 27001, 27017 and 27018. It protects the software lifecycle of Italian and European organizations from design to production: SBOM, vulnerability scanning, code signing and SLSA compliance in CI/CD pipelines.

How is Supply Chain Security integrated into CI/CD pipelines?

Integration occurs at multiple pipeline stages:

  • Pre-commit: dependency scanning and secrets detection
  • Build: SBOM generation, artifact signing, attestations
  • Test: vulnerability scanning, policy check
  • Deploy: signature verification, Kubernetes admission control

We use tools like Trivy, Syft, Cosign, Kyverno to automate all checks.

How much does it cost to implement Supply Chain Security?

Investment depends on environment complexity:

  • Number of repositories and pipelines to protect
  • Required compliance level (basic, SLSA, NIS2)
  • Integration with existing systems
  • Choice between one-time implementation or managed service

The investment often comes from a regulatory obligation (NIS2, DORA, CRA). We discuss it in a first conversation, with no commitment.

Where to go next.

Talk to the CEO or the CTO.

Tell us which pipelines you use and which regulations apply to you. We will tell you which control we would start with.

Tell us about your project
CEO Stefano MainardiBook 30 minutes CTO Paolo MainardiBook 30 minutes

Updated