Supply Chain & Third-Party Risk

# SBOM Risk Analysis Script
# Analyzes CycloneDX SBOM for supply chain risk indicators

import json
from dataclasses import dataclass, field
from datetime import datetime, timezone


@dataclass
class DependencyRisk:
    name: str
    version: str
    risk_score: float = 0.0
    risk_factors: list = field(default_factory=list)


def analyze_sbom(sbom_path: str) -> list[DependencyRisk]:
    """Analyze SBOM for supply chain risk indicators."""
    with open(sbom_path, "r") as f:
        sbom = json.load(f)

    findings = []
    components = sbom.get("components", [])

    for comp in components:
        risk = DependencyRisk(
            name=comp.get("name", "unknown"),
            version=comp.get("version", "unknown"),
        )

        # Check for known vulnerabilities
        vulns = comp.get("vulnerabilities", [])
        if vulns:
            critical = sum(
                1 for v in vulns
                if v.get("severity", "").lower() == "critical"
            )
            risk.risk_score += critical * 25 + len(vulns) * 5
            risk.risk_factors.append(
                f"{len(vulns)} known vulns ({critical} critical)"
            )

        # Check for outdated components
        licenses = comp.get("licenses", [])
        if not licenses:
            risk.risk_score += 10
            risk.risk_factors.append("No license declared")
        else:
            for lic in licenses:
                license_id = lic.get("license", {}).get("id", "")
                if license_id in ("AGPL-3.0", "GPL-3.0-only"):
                    risk.risk_score += 15
                    risk.risk_factors.append(
                        f"Copyleft license: {license_id}"
                    )

        # Check supplier information
        supplier = comp.get("supplier", {})
        if not supplier:
            risk.risk_score += 10
            risk.risk_factors.append("No supplier information")

        # Flag components without hashes
        hashes = comp.get("hashes", [])
        if not hashes:
            risk.risk_score += 15
            risk.risk_factors.append("No integrity hashes")

        if risk.risk_factors:
            findings.append(risk)

    # Sort by risk score descending
    findings.sort(key=lambda r: r.risk_score, reverse=True)
    return findings


def generate_risk_report(findings: list[DependencyRisk]) -> str:
    """Generate supply chain risk summary report."""
    lines = ["Supply Chain Risk Analysis Report"]
    lines.append("=" * 40)
    lines.append(
        f"Analysis Date: "
        f"{datetime.now(timezone.utc).strftime('%Y-%m-%d %H:%M UTC')}"
    )
    lines.append(f"Components Analyzed: {len(findings)} with findings")
    lines.append("")

    high_risk = [f for f in findings if f.risk_score >= 50]
    medium_risk = [f for f in findings if 20 <= f.risk_score < 50]
    low_risk = [f for f in findings if f.risk_score < 20]

    lines.append(f"HIGH RISK:   {len(high_risk)} components")
    lines.append(f"MEDIUM RISK: {len(medium_risk)} components")
    lines.append(f"LOW RISK:    {len(low_risk)} components")

    for risk_level, items in [
        ("HIGH", high_risk),
        ("MEDIUM", medium_risk),
    ]:
        if items:
            lines.append(f"\n--- {risk_level} RISK ---")
            for item in items[:10]:
                lines.append(
                    f"  {item.name}@{item.version} "
                    f"(score: {item.risk_score})"
                )
                for factor in item.risk_factors:
                    lines.append(f"    - {factor}")

    return "\n".join(lines)

SaaS Vendor Risk Assessment Checklist
═════════════════════════════════════

DATA SECURITY
  □ Where is data stored? (region, jurisdiction)
  □ Encryption at rest (algorithm, key management)
  □ Encryption in transit (TLS version, cipher suites)
  □ Data isolation model (single-tenant vs multi-tenant)
  □ Data retention and deletion policies
  □ Right to audit clause in contract

ACCESS CONTROL
  □ SSO/SAML/OIDC integration available?
  □ SCIM provisioning supported?
  □ IP allowlisting capability
  □ Role-based access control granularity
  □ MFA enforcement options
  □ Session management controls

INCIDENT RESPONSE
  □ Documented incident response plan?
  □ Breach notification SLA (e.g., 72 hours for GDPR)
  □ Customer communication process
  □ Post-incident report provided?
  □ Insurance coverage

COMPLIANCE & ASSURANCE
  □ SOC 2 Type II report (current period)
  □ ISO 27001 certification (current)
  □ Penetration test results (redacted OK)
  □ GDPR / CCPA compliance attestation
  □ Industry-specific (PCI, HIPAA, FedRAMP)

EXIT STRATEGY
  □ Data export format and mechanism
  □ Data deletion confirmation upon termination
  □ Transition assistance period
  □ API data extraction capability
  □ Contract termination notice period