Blockchain-based model for tracking compliance with security requirements

The increasing threat landscape in Industrial Control Systems (ICS) brings
 different risk profiles with comprehensive impacts on society and safety.
 The complexity of cybersecurity risk assessment increases with a variety of
 third-party software components that comprise a modern ICS supply chain. A
 central issue in software supply chain security is the evaluation whether
 the secure development lifecycle process (SDL) is being methodologically and
 continuously practiced by all vendors. In this paper, we investigate the
 possibility of using a decentralized, tamper-proof system that will provide
 trustworthy visibility of the SDL metrics over a certain period, to any
 authorized auditing party. Results of the research provide a model for
 creating a blockchain-based approach that allows inclusion of auditors
 through a consortium decision while responding to SDL use cases defined by
 this paper. The resulting blockchain architecture successfully responded to
 requirements mandated by the security management practice as defined by IEC
 62443-4-1 standard.