Establishment of the Security Transparency Consortium to address supply chain security risks

Tokyo -October 11, 2023 - NTT Corporation (NTT) and NEC Corporation (NEC) have established "Security Transparency Consortium" to reduce supply chain security risks. NTT and NEC are responsible for the management of the consortium, and ALAXALA Networks Corporation, NTT Data Corporation, FFRI Security, Inc., Cisco Systems GK, Hitachi, Ltd., and Mitsubishi Electric Corporation, will be the initial participants. Through the efforts of the Consortium, we will contribute to resolve social issues, including the response to supply chain security risks, by enhancing and enabling the use of security transparency in products, systems, services, etc.

1. Background

In recent years, supply chain security has become an issue, as products, systems and services are subject to security breaches through the supply chain in their procurement, maintenance, and operation. In Japan, the promulgation of the Law for the Promotion of Economic Security has led to an increase in interest in these risks and the need to address them. In addition, in countries around the world, there is an increasing demand for each business operator in the supply chain to create and provide "visualization data" on software configurations based on the SBOM format ^[1], a list of ingredients that make up software components.

2. Purpose of the establishment

Since the creation and provision of visualization data entails cost burdens for suppliers of products, it is essential to effectively utilize visualization data at an appropriate cost. The Security Transparency Consortium was established to contributes to the use of visualized data through the cooperation of the various businesses that form the supply chain (product vendors, system integrators, security vendors, businesses that use and operate products, systems, services, etc.).
　The consortium is aiming to expand the usage scene by sharing the knowledge and know-how of each company's visualization data. Specifically, we will analyze issues, consider solutions, and demonstrate the use of transparency enhanced by visualization data, such as software configuration for security operations. To address this issue from a broader perspective, we expect participation of a variety of businesses, not limited to specific industries or fields, examine the use of visualization data from the perspectives of both providers and users. By disclosing the results of the study, we will promote community activities and cooperate with government agencies, with the aim of contributing to solving social issues, such as the response to supply chain security risks.

3. Participating businesses (as of September 2023)

The following companies participated in the consortium at its inception. NTT and NEC are responsible for the management of the consortium. We will also start recruiting additional participants on our website ^[2].

4. Outlook

We will work to expand our business through the publication of a white paper summarizing the details of this initiative (concept, plan, etc.). In addition, we will analyze issues related to the use of visualization data, examine solutions, and demonstrate them. The results will be published as a "Best Practices for Visualization Data Utilization (tentative)."

^[1]Software Bill of Materials:
a nested inventory for software, a list of ingredients that make up software components.
https://www.ntia.gov/

^[2]Security Transparency Consortium HP
URL：https://www.st-consortium.org

^[3]Through NTT Corporation's participation, the following NTT Group companies will also cooperate with the Consortium.
NTT East Corporation
NTT Corporation
NTT Communications Corporation
NTT DOCOMO, INC.
NTT Advanced Technology Corporation
NTT TechnoCross Corporation

About NTT

NTT contributes to a sustainable society through the power of innovation. We are a leading global technology company providing services to consumers and business as a mobile operator, infrastructure, networks, applications, and consulting provider. Our offerings include digital business consulting, managed application services, workplace and cloud solutions, data center and edge computing, all supported by our deep global industry expertise. We are over $95B in revenue and 330,000 employees, with $3.6B in annual R&D investments. Our operations span across 80+ countries and regions, allowing us to serve clients in over 190 of them. We serve over 75% of Fortune Global 100 companies, thousands of other enterprise and government clients and millions of consumers.