International · technical specification
SCITT: what it asks, and the records to keep
SCITT defines how signed statements about supply chain artifacts are registered on an append-only transparency service that returns a signed receipt proving registration. RFC 9943, published as an IETF Proposed Standard in June 2026, gives independently checkable records of claims such as SBOMs, test results or provenance.
01 / What it asks
What SCITT asks
Issuers of supply chain statements (e.g. software producers, auditors), operators of transparency services, and relying parties that verify them.
- 01Issuers sign statements as COSE_Sign1 messages about a specific artifact.
- 02Transparency services keep an append-only, non-equivocating log that cannot modify, delete or reorder entries.
- 03Transparency services publish and apply a registration policy, itself recorded on the log.
- 04Transparency services register a statement before releasing its COSE receipt (RFC 9942).
- 05Relying parties and auditors verify receipts and log consistency rather than trusting the operator.
02 / AI work
Where it touches AI work
Any statement about an AI artifact, such as a model card, evaluation result or dataset hash, can be registered and receipted. The RFC targets software supply chains and does not address AI specifically.
03 / Dates
The dates that matter
Architecture draft-22, final Internet-Draft before RFC
RFC 9943 (architecture) and RFC 9942 (COSE Receipts) published
SCITT Reference APIs draft-11; now in RFC Editor queue
04 / Enforcement
Who enforces it
None; voluntary.
05 / Records
Records an organisation keeps
What an auditor or an inquiry usually asks to see. Your obligations depend on your role and your facts.
- 01Signed statements with their COSE receipts
- 02Transparency service registration policy
- 03Auditor log consistency checks
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
QUESTIONS
The questions that come next
Is SCITT a final standard yet?+
Partly. The SCITT architecture was published in June 2026 as RFC 9943, an IETF Proposed Standard, together with RFC 9942 on COSE Receipts. It defines how signed statements about supply chain artifacts are registered on an append-only transparency service that returns a receipt proving registration. The companion SCITT Reference APIs specification (draft-ietf-scitt-scrapi-11) is approved and waiting in the RFC Editor queue without an RFC number. SCITT is a voluntary standard; no law requires it. Read the full answer
SOURCES
Go back to the source
RFC Editor
IETF Datatracker
CHANGE LOG
What changed, and when
Rebuilt from primary sources; facts checked on this date.
Related: SCITT vs SLSA v1.0 · SCITT vs SBOM · SCITT for defense AI workflows · ISO/IEC 42001 · SLSA v1.0 · ISO/IEC 42001 · Annex A · GMLP