Software Supply-Chain Risk Management

**Executive Summary:** This report describes the rising threat of software supply-chain compromises, explains common manipulation techniques (source code/update tampering, dependency/backdoor insertion, and code-signing theft), presents real-world case studies (3CX, XZ Utils, Nvidia/Lapsus$, SolarWinds/NotPetya), and recommends mitigations including C-SCRM practices, SBOMs, secure development frameworks, credential and certificate protections, and detection/response playbooks.