SCITT vs SLSA v1.0.
Two regulatory anchors. Planisphere's evidence record maps both controls. This page is the comparison query's canonical destination.
When to lead with SCITT.
Audience. supply-chain integrity, transparency, trust · IETF.
Shape. receipt · brass roll edge + brass corner seal.
Where it lives in the record. The SCITT cite-anchor pins next to every artifact in ATTESTATION.json. See the SCITT brief for the field-level mapping.
When to lead with SLSA v1.0.
Audience. supply-chain levels for software artifacts.
Shape. ascending staircase · 3 tiers · brass target rung.
Where it lives in the record. The SLSA v1.0 cite-anchor pins next to every artifact in ATTESTATION.json. See the SLSA v1.0 brief for the field-level mapping.
Both at once.
Planisphere's evidence record is multi-control by construction. SCITT and SLSA v1.0 are both keys in the record's requirement list; the same SHA-pinned, Merkle-rooted artifact gives both evaluators a shared review record.
The requirement list is open — add any standard the regulator names. See the full compliance-control register.