The guideline provides an overview of software supply chain risk and how vendors and customers can identify and assess such risks using the NIST Cyber Supply Chain Risk Management (C-SCRM) Framework and the Secure Software Development Framework (SSDF).