Planisphere Download for Mac

Question · SCITT

Is SCITT a final standard yet?

SCITT defines how signed statements about supply chain artifacts are registered on an append-only transparency service that returns a signed receipt proving registration.

AboutSCITT
Legal forceVoluntary standard
Applies fromJune 2026
Checked21 Oct 2026

01 / The answer

The short answer

Partly. The SCITT architecture was published in June 2026 as RFC 9943, an IETF Proposed Standard, together with RFC 9942 on COSE Receipts. It defines how signed statements about supply chain artifacts are registered on an append-only transparency service that returns a receipt proving registration. The companion SCITT Reference APIs specification (draft-ietf-scitt-scrapi-11) is approved and waiting in the RFC Editor queue without an RFC number. SCITT is a voluntary standard; no law requires it.
SCITT · checked 21 Oct 2026

02 / The rule

What SCITT requires

SCITT defines how signed statements about supply chain artifacts are registered on an append-only transparency service that returns a signed receipt proving registration. RFC 9943, published as an IETF Proposed Standard in June 2026, gives independently checkable records of claims such as SBOMs, test results or provenance.

  1. 01Issuers sign statements as COSE_Sign1 messages about a specific artifact.
  2. 02Transparency services keep an append-only, non-equivocating log that cannot modify, delete or reorder entries.
  3. 03Transparency services publish and apply a registration policy, itself recorded on the log.
  4. 04Transparency services register a statement before releasing its COSE receipt (RFC 9942).

03 / Records

Records to keep

  1. 01Signed statements with their COSE receipts
  2. 02Transparency service registration policy
  3. 03Auditor log consistency checks

Optional evidence · where Planisphere fits

Keep a record anyone can check

When your team meets a duty, Planisphere can seal the event it reports as a receipt.

01 · Your teamRecord the event

A disclosure shown, a review signed, a model change approved: the event your system reports.

02 · PlanisphereSeal it

The event becomes a sealed receipt, dated and attributed to whoever is signed in.

03 · AnyoneCheck it

Paste the receipt into Verify. No account or key.

A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.

SOURCES

Go back to the source

PRIMARY

RELATED

Related: SCITT: the full guide