Turn Gaps into Targeted Questions and Decisions

A weak or incomplete Scorecard result is not the end of a software-vendor review, and it is not automatically a reason to send a longer questionnaire. It is a signal about what the current evidence could not establish. This chapter turns that signal into a proportionate next move: map the gap back to the right NIST concern, request the narrowest corroborating evidence, and choose among remediation, acceptance, escalation, or a policy gate. The aim is to make supplier contact more precise while keeping the decision anchored in evidence rather than assurances.

The central discipline is to preserve the type of uncertainty. A repository check may show an observable development practice, fail to find one, or be unable to evaluate the implementation. NIST's due-diligence model may identify a material question about ownership, foreign influence, resilience, product performance, or a sub-tier relationship. Those gaps do not belong to the same instrument. The first decision is therefore not “what question is missing from our form?” It is “what claim would change the decision, and what source can actually test it?”

Map a technical gap back to the right C-SCRM question

OpenSSF Scorecard contributes most directly to NIST's Foundational Cyber Practices, especially the product-development side, and to selected parts of software provenance. Its checks can reveal signals about branch protection, code review, dependency pinning, known vulnerabilities, workflow permissions, release assets, or related repository practices. Those observations are useful because they connect to concrete failure surfaces in the software supply chain.

They do not cover all five NIST categories equally. A repository result can inform how code is reviewed or how dependencies enter a build. It cannot establish who beneficially owns the supplier, whether a foreign law can compel disclosure of sensitive information, whether the supplier is financially able to meet the contract, whether a product performs reliably, or which legal entity controls an unlisted sub-tier relationship. Those questions require company, legal, product, operational, or supply-chain evidence.

A gap becomes actionable when its category and consequence are explicit. Consider four common patterns.

The tool does not recognize the implementation. Scorecard documents that checks such as CI testing, SAST, fuzzing, packaging, and dependency updates may miss alternative tools or workflows. A low result can therefore indicate a detection boundary rather than the absence of the practice. The targeted question should ask what mechanism is used, where it is configured, which recent run demonstrates it, and what evidence shows that someone acts on its output. “Do you use secure development?” adds little. “Which process performs this function for the product in scope, and what dated artifact demonstrates a recent successful run?” tests a specific gap.

The tool sees presence but not effectiveness. The Dependency-Update-Tool check can detect whether Dependabot or Renovate is enabled, but not whether updates run or their pull requests are merged. A positive result supports a configuration claim. It does not establish that the deployed dependency set is current. The follow-up should be about the transition from notification to action: how updates are assessed, who approves them, how exceptions are recorded, and what evidence shows that the product receives relevant fixes. The request is narrower than a questionnaire because it follows the boundary of the check.

The tool detects an artifact without verifying it. Scorecard's Signed-Releases check looks for recognized signature or provenance asset names but does not verify signatures. A supplier can be asked for the verification method, expected signing identity, relationship between the signed artifact and the source revision, and evidence that the buyer will receive that artifact. The question is not whether the supplier “supports signed releases.” It is whether the specific release under consideration can be authenticated and linked to the product being purchased.

The technical result is strong but the broader concern remains open.